Discovering and mapping the relationships between macro-clusters of a computer network topology for an executing application

ABSTRACT

There are disclosed devices, system and methods for mapping relationships between macro-clusters of a network object topology of a computer communication network. A remote network object of the network is selected that has a relationship with one macro-cluster that has a relationship with another macro-cluster. Flow log data, metric data and configuration data are gathered from at least the selected network object. Configuration data and time data are generated for the sets network objects of the two macro-clusters using the gathered flow log data, metric data and configuration data. Network topology information is created using the configuration data and time data. The network topology information includes topology information for the relationship between the macro-clusters, for each macro-cluster and for the sets of network objects of the macro-clusters. The topology information can be stored and used to determine whether performance issues occur in the macro-clusters or relationship over time.

RELATED APPLICATION INFORMATION

This patent is a continuation of and claims priority from U.S. patentapplication Ser. No. 16/543,372, entitled “DISCOVERING AND MAPPING THERELATIONSHIPS BETWEEN MACRO-CLUSTERS OF A COMPUTER NETWORK TOPOLOGY FORAN EXECUTING APPLICATION” filed Aug. 16, 2019, which is incorporatedherein by reference.

NOTICE OF COPYRIGHTS AND TRADE DRESS

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. This patent document may showand/or describe matter which is or may become trade dress of the owner.The copyright and trade dress owner has no objection to the facsimilereproduction by anyone of the patent disclosure as it appears in thePatent and Trademark Office patent files or records, but otherwisereserves all copyright and trade dress rights whatsoever.

BACKGROUND Field

This disclosure relates to discovering and mapping relationships betweenmacro-clusters of a computer network topology for an executingapplication.

Description of the Related Art

Current computer network topology mapping tools or devices are generallyunable to automatically discover the topology of network objects of anetwork communicating with an application at a large scale, store thetopology and allow quick access to the topology information. Some suchtools require access to sensitive information. Some do not performrepeated discovery, compare changes, addressing large scale and dealingwith missing critical data. Some do not automatically group resources(like a cluster or a service) or collect critical metrics for eachnetwork object. Such tools also do not provide a graph representation ofthe topology that mixes data that is not pure graphical and/or that hasdata with time dimension. They also do not provide such a representationthat maps relationships between macro-clusters of the topology.

DESCRIPTION OF THE DRAWINGS

FIG. 1A is a computer communication network having a system fordiscovering and mapping the relationships between macro-clusters oftopology information for a selected application executing on a selectednetwork object.

FIG. 1B is a computer communication network showing certainrelationships between two specific macro-clusters for a selectedapplication executing on a selected network object.

FIG. 1C is a computer communication network showing certainrelationships between two specific macro-clusters for a selectedapplication executing on a selected network object.

FIG. 1D is a computer communication network showing no relationshipsbetween two specific macro-clusters for a selected application executingon a selected network object.

FIG. 2 is a portion of the network of FIG. 1A that includes the systemfor discovering and mapping the relationships between macro-clusters andthe selected executing application.

FIG. 3 is an operating environment/process for discovering and mappingthe relationships between macro-clusters of the topology information ofthe selected executing application of the computer communicationnetwork.

FIG. 4 shows a graph representation of the relationships betweenmacro-clusters of topology information of the computer network for theselected application for a period of time.

FIG. 5 is a block diagram of a computing device.

Throughout this description, elements appearing in figures are assignedthree-digit reference designators, where the most significant digit isthe figure number and the two least significant digits are specific tothe element. An element that is not described in conjunction with afigure may be presumed to have the same characteristics and function asa previously-described element having a reference designator with thesame least significant digits.

DETAILED DESCRIPTION

Technologies described herein provide systems and methods for continualautomated discovering over time of a topology of network objects of aselected application executing on a computer communication network. Thetechnologies also provide systems and method for discovering and mappingthe relationships between macro-clusters of the topology. The system maybe an efficient information technology (IT) discovery engine existing astwo physical network objects of the computer network that accesses thenetwork object on which the application is executing.

Herein, a network “topology” may be or include the network's “topologyinformation.” Also, herein, “discovering” the relationships betweenmacro-clusters may be part of the continual automated discovering overtime of the topology. Next, herein, “mapping” the relationships betweenmacro-clusters may be part of creating topology information and/ordisplaying a graphic representation of the topology information. Also,herein, the “relationship” between two macro-clusters may be or have atleast one type of relationship and/or at least one type ofcommunications between two macro-clusters. For example, a relationshipbetween two macros-clusters may be all the relationships between eachnetwork object of one macro-cluster and each network object of therelated macros-cluster which may include all of the types ofrelationships between each related two network objects of thosemacro-clusters. Finally, herein, the “relationship” between twomacro-clusters may also include the topology information of the networkobjects included in the two macro-clusters.

Description of Apparatus

Referring now to FIG. 1A, there is shown a computer communicationnetwork 100 having a system 102 for discovering and mapping therelationships between macro-clusters of topology information; and/ordisplaying a graph representation of those relationships. Therelationships are part of topology information of network objects for aselected application 114 executing on a selected network object 110 c.In some cases, the “discovering” of relationships also includes somemanual intervention to input part of the topology information orrelationships of one or more network objects. The computer communicationnetwork 100 is a computer network or network that includes the networkobjects 110 a-110 i, 120 and 130. The software application 114 isexecuting or running on the network object 110 c. The related executingapplication 116 is executing or running on the network object 110 e. Thenetwork objects 110 a, 110 c and 110 e are independent or stand-alonenetwork objects. The network objects 110 b and 110 d are part ofmacro-cluster of network objects 160 which is a macro-cluster group ofnetwork objects, a micro-service group of network objects and/or amacro-component group of network objects. The network objects 110 f and110 g are part of a cloud service network objects 140 which is amacro-cluster group of network objects, a micro-service of networkobjects, and/or a macro-component group of network objects. The networkobjects 110 h and 110 i are part of macro-cluster of network objects 150which is a macro-cluster group of network objects, a micro-service groupof network objects and/or a macro-component group of network objects.The cloud service network objects 140 is not related to and has no typeof relationship with either the macro-cluster 150 or 160. Themacro-cluster 150 is related to, has a relationship 186 with and has atype of relationship with the macro-cluster 160.

In another case that is not shown the figures, the selected object 110 cis included in and part of macro-cluster of network objects 160. Also,in another case that is not shown the figures, the related object 110 eis included in and part of macro-cluster of network objects 150. Infact, those objects may be part of those clusters at the same time.

Each of the network objects 110 a-110 i, 120 and 130 may be a physicalnetwork object, a virtual network object or another network element. Anynumber of those network objects are related to the application 114 suchas by influencing the execution of, receiving data from and/or sendingdata to the application 114. A physical network object or a type ofphysical network object is at least one of a physical host, a physicaldisk (e.g., within a server or attached to a server in a cloudsituation), a physical load balancer, a server, a client, a physicalinternal service, a desktop, a router, a node, a network switch, alaptop or other computing device, such as device 500 FIG. 5. A virtualnetwork object or type of virtual network object is at least one of avirtual host, a virtual disk, a virtual load balancer, a database, alogical clustered group of resources, a macro-component, a virtualmacro-cluster of network objects, a physical macro-cluster of networkobjects, a logical service, a virtual internal service, a virtualcomputing device, that exists on or is a device 500 FIG. 5. Each of thenetwork objects may include at least one communication interface forcommunicating with at least one other network object, such as interface516 in FIG. 5.

In some cases, application 114 has parts or plug-ins executing onanother network object; or is communicating data with another networkobject. For example, network object 110 e is related to object 110 c andhas related executing application 116 that is related to the application114 because the applications 114 and 116 are communicating data witheach other as a result of the execution of application 116. For example,the application 114 may be a server application which is sending webpagedata to the application 116 which is a client application displaying thewebpage to a user, and the topology for the server is being determined.It can be appreciated that this relationship of the applications 114 and116 could be reversed and the system 102 would be mapping out thetopology for the client computer. Also, the object 110 f is related tothe object 110 c because the application 114 is obtaining data throughthe object 110 f from a disc or database of the object 110 g. Forexample, the object 110 f may be a router or Internet switch which isrouting advertisements from ad server source object 110 g to theapplication 114. Network object 110 b has relationship 182 with object110 d by having at least one type of relationship between network object110 b and object 110 d. Network object 110 h has relationship 184 withobject 110 i by having at least one type of relationship between networkobject 110 h and object 110 i. Macro-cluster 150 has relationship 186with macro-cluster 160 by having at least one relationship betweenmacro-cluster 150 and macro-cluster 160. The relationship 186 is anyrelationship between one of the network objects of macro-cluster 150 andone of the network objects of macro-cluster 160. For example,relationship 186 may be a relationship between network object 110 b andnetwork object 110 i. Relationship 186 can include additionalrelationships between network objects of macro-cluster 150 and 160 suchas by also including a relationship between network objects 110 b and110 h; 110 d and 110 h; and/or 110 d and 110 i. Each of theserelationships between macro-clusters and/or network objects may be oneor more of many types of relationships as noted herein. Otherrelationships between network objects of network 100 are also consideredas noted herein and the network objects related to application 114 willbe included in the topology information.

Specifically, FIG. 1B is a computer communication network 115 showingcertain relationships between two specific macro-clusters 150 and 160for a selected application 114 executing on a selected network object110 c. The computer communication network 115 may be similar to network100 where relationship 186 is or includes at least one relationshipbetween each of the network objects of macro-cluster 150 and each of thenetwork objects of macro-cluster 160. Here, as shown, relationship 186may be a relationship 186 a between macro-clusters 150 and 160 that is arelationship between network object 110 b and network object 110 h, arelationship between network object 110 b and network object 110 i, arelationship between network object 110 d and network object 110 h, anda relationship between network object 110 d and network object 110 i.

Each of these relationships between network objects may be one or moreof many types of relationships as noted herein. These relationshipsbetween network objects of network 115 have relationship types and willbe included in the topology information as noted herein.

FIG. 1C is a computer communication network 125 showing certainrelationships between two specific macro-clusters 150 and 160 for aselected application 114 executing on a selected network object 110 c.The computer communication network 125 may be similar to network 100where relationship 186 is or includes only one relationship between oneof the network objects of macro-cluster 150 and one of the networkobjects of macro-cluster 160. Here, as shown, relationship 186 may be arelationship 186 b between macro-clusters 150 and 160 that is therelationship between network object 110 b and network object 110 i. Thisrelationship between network objects may be one or more of many types ofrelationships as noted herein. This relationship will have arelationship type and will be included in the topology information asnoted herein.

FIG. 1D is a computer communication network 135 showing no relationshipsbetween two specific macro-clusters 150 and 160 for a selectedapplication 114 executing on a selected network object 110 c. Thecomputer communication network 135 may be similar to network 100 whererelationship 186 is or includes zero or no relationship between any ofthe network objects of macro-cluster 150 and any of the network objectsof macro-cluster 160. Here, as shown, there is no relationship 186between macro-clusters 150 and 160. That there is no relationship willbe included in the topology information as noted herein.

The network 100 includes the network object 120 and the separate networkobject 130 which together are the system 102. The system 102 may includeadditional components. In one case, the objects 120 and 130 may be thesame network object. The network object 130 includes the server 130 aand may include the user input/output (TO) device 170 having the display172 and the user input 174. The server 130 a may be a network object asnoted herein. The device 170 may be a server, client, desktop, laptop orother computing device, such as noted for device 500 FIG. 5. The display172 may be or include a computer display, touchscreen or other devicecapable of rendering or displaying computer graphics. The input 174 maybe or include a computer input device, such as a keyboard, mouse,touchpad, touchscreen, voice activated input and/or the like.

The network 100 includes and FIG. 1A shows network connections betweenthe network objects, as shown by the lines connecting pairs of thenetwork objects. Specifically, the object 120 is connected to theobjects 110 c, 110 e and 110 f. Also, the object 110 c is connected tothe objects 110 a, 110 e, 120, 140 and 110 i. The object 110 b isconnected to the object 110 d; the object 110 i is connected to theobject 110 h; the object 110 d is connected to the object 110 e; and theobject 110 f is connected to the object 110 g. Each connection mayrepresent a connection between the network interfaces of each of theobjects being connected. Such connections may be or include network:connections communication channels, routers, nodes, network switches,hardware, software, wired connections, wireless connections and/or thelike. In some cases, each connection may represent one of differentpossible types of relationships like a physical connection, a logicalconnection, a dependency relationship and/or any other type ofrelationship between the two objects. Each connection may be arelationship and/or a type of relationship between one or more pairs ofnetwork objects. Thus, for each connection, the pair of objects and anymacro-clusters in which those objects exist are related. Each networkconnection may be capable of being used to communicate network data,packets, network messages, calls, signals, streams, arrays, flaggedsamples and feedback described herein.

The “selected” application 114 is an application, a component, and/or anetwork object of a network that it is desired to discover the networktopology or topology information of. The network object 110 c is a“selected” object such as by being the selected network object and/or anetwork object upon which the selected software application 114 isexecuting. For example, the network 100 may be an environment in whichthe system 102 can continually and automatically discover over time, atopology of the network 100 that is involved in execution of or accessedduring execution of the selected application 114 which is executing onthe network object 110 c thus making object 110 c a “selected” networkobject.

The “selected” application 114 may be an application, a component,and/or a network object that it is believed has a relationship with orwill provide configuration and time data 217 to show network topologyinformation desired to discover the network topology or topologyinformation of related macro-clusters 150 and 160. As noted above, theselected object 110 c may be separate from or included in amacro-cluster 150. In these cases, for example, the network 100 may bean environment in which the system 102 can continually and automaticallydiscover over time, a topology of the related macro-clusters 150 and 160that are related to the execution of or accessed during execution of theselected application 114, thus making object 110 c a “selected” networkobject.

The selected application 114 may be selected by a user having access tosystem 102. The user may be an analyst, administrator, or other person;or a software application having access to the system 102. The input 174of the input/output (I/O) device 170 may be used by the user to select(e.g., predetermine or identify) the selected application 114, that itis desired to discover the topology of. This selection may cause thesystem 102 to perform continual automated discovering over time of thetopology of network objects for or communicating with the executingapplication 114. Discovering the topology may occur for a selectedperiod of time and for additional subsequent periods of time as notedherein.

Referring now to FIG. 2, there is shown a portion 200 of network 100that includes the system 102 and the selected executing application 114executing on the network object 110 c of FIG. 1A. The network object 120is connected by network connections to and between the network object130 and: the selected network object 110 c, the related network object110 e and the related network object 110 f as shown.

The network object 120 includes at least a collector 210, a scheduler219, configuration and time dimension information (CTD), and timeseries(TS) information 217, and two or more of sources 211-216 for sending theinformation 217 to the collector 210. Herein, the information 217 may bereferred to in separate parts as a configuration and time dimensioninformation (CTD) part, and a timeseries (TS) information part of theinformation 217. It may also be referred to together as the CTD and TSinformation 217. The two or more sources includes a configuration sourceand at least either a flow logs source or a metrics source. Additionalsources may also be used to collect the information 217.

In some cases, there is one configuration source that is connected toeach network object the collector 210 is collecting the information 217from. The configuration source may collect configuration informationregarding how each network object is configured that is used to producethe information 217. There is also a number of metric sources connectedto any number of the network objects the collector 210 is collecting theinformation 217 from. Each metrics source may collect metricsinformation regarding a type of metrics for a network object that isused to produce the information 217. More than one metric source can beconnected to any single network object to collect more than one type ofmetrics from that object. There is also a number of flow logs sources,each connected to any of the network objects the collector 210 iscollecting the information 217 from. Each flow logs source may collectflow logs information for or from a network object that is used toproduce the information 217. Each flow logs source can be reading orcopying the flow logs of a switch, node or flow logs providing service.

As shown in FIG. 2, the object 120 has a metrics source A 211, a metricssource B 212, a flow logs source 213, and a configuration source 216 forcollecting the information 217 from the selected object 110 c and/or theselected application 114. More specifically, the configuration source216 is connected by network connections to and receives configurationinformation from the selected object 110 c as part of the information217. It may detect configuration information of or for the selectedobject 110 c based on the execution of the application 114 and send thatconfiguration information to the collector 210. For example,configuration source 216 may be collecting configuration informationsuch as text identifying internet protocol (IP) addresses, logical mediaaccess control (MAC) address, physical MAC address, internal disc types,CPU types, random access memory (RAM) memory types, read only memory(ROM) data, switch/node configuration data, switch data routing data,and other configuration data of each network object.

Next, the metrics source A 211 and the metrics source B 212 areconnected by network connections to and receive metrics information fromthe selected object 110 c as part of the information 217. They maycollect and send to the collector 210 two different types (e.g., type Aand B) of metrics information as based on the execution of theapplication 114. For example, the metrics source A 211 may be collectingthe metrics information of the memory, computer processing unit (CPU)and inputs/outputs (IOs) performed by one hard drive (e.g., by disk 1)of the object 110 c; while the metrics source B 212 is collecting themetrics information of the inputs/outputs (IOs) performed by a secondhard drive (e.g., by disk 2) of the object 110 c.

Also, the flow logs source 213 is connected by network connections toand receives data from the flow logs 244 of or within the selectedobject 110 c as part of the information 217. In some cases, as notedfurther below, each flow log of the logs 244 may include data in all orsome of the following fields: version, account-id, interface-id,srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start,end, action, log-status. The source 213 may read the flow logs 244 andsend all or part of those logs as flow logs information to the collector210. For example, the flow logs source 213 may be collecting or readingflow logs information including the source network object (e.g., sourceIP address), target network object (e.g., target IP address) andpossibly type of communication of the communication messages of the flowlogs for the network communication traffic at or flowing through theobject 110 c. As noted, the network object 110 e is related to theobject 110 c due to data communication between applications 114 and 116.Thus, the flow logs information of information 217 collected from theobject 110 c may include flow logs 244 of the communication between theapplications 114 and 116, and/or the objects 110 c and 110 e. Also, asnoted, the network object 110 f is related to the object 110 c becausethe application 114 is obtaining data from the object 110 g through theobject 110 f. Thus, the configuration information and/or metricsinformation of information 217 collected from the object 110 c mayinclude information related to the communication between the objects 110c and 110 f.

The network object 110 b has relationship 182 with object 110 d, theobject 110 d is related to the object 110 e, and the object 110 e isrelated to object 110 c. Thus, any of the flow logs information (e.g.,data), configuration information and/or metrics information ofinformation 217 collected from the object 110 c, 110 e and/or 110 f mayinclude information identifying the relationship 182 between the objects110 b and 110 d.

The network object 110 h has relationship 184 with object 110 i, and theobject 110 i is related to the object 110 c. Thus, any of the flow logsinformation (e.g., data), configuration information and/or metricsinformation of information 217 collected from the object 110 c, 110 eand/or 110 f may include information identifying the relationship 184between the objects 110 h and 110 i.

The macro-cluster 150 has relationship 186 with the macro-cluster 160,and the object 110 i is related to the object 110 c. Thus, any of theflow logs information (e.g., data), configuration information and/ormetrics information of information 217 collected from the object 110 c,110 e and/or 110 f may include information identifying the relationship186 between the macro-cluster 150 and macro-cluster 160. Thisinformation may include information identifying one or more types ofrelationships between the macro-clusters 150 and 160. It may also,include information identifying relationships any of the network objectsof macro-cluster 150 have with any of the network objects ofmacro-cluster 160.

Further, as shown in FIG. 2, the object 120 has a metrics source C 214,and the configuration source 216 for collecting the information 217 fromthe related object 110 e. The metrics source C 214 is connected to andreceive metrics information from the related network object 110 e; andsend that as the TS part of the information 217 to the collector 210such as noted for the metrics sources A 211 and B 212 collecting themetrics information of the object 110 c. The configuration source 216 isconnected to and receives configuration information from the relatedobject 110 e; and sends that as the CTD part of the information 217 tothe collector 210 such as noted for the configuration source 216collecting the configuration information of the object 110 c. As noted,the network object 110 e is related to the object 110 c because theapplication 114 is a server application which is sending webpage data tothe application 116 which is a client application displaying the webpageto a user. Thus, the configuration information and/or metricsinformation of information 217 collected from the object 110 e mayinclude information related to the communication between the objects 110c and 110 e.

In addition, as shown in FIG. 2, the object 120 has a flow logs source215 and the configuration source 216 for collecting the information 217from the related object 110 f. The flow logs source 215 is connected toand receives flow logs information from the flow logs 246 of the relatednetwork object 110 f; and sends that as part of the CTD part of theinformation 217 to the collector 210 such as noted for the flow logssource 213 reading the flow logs 244 of the object 110 c. Theconfiguration source 216 is connected to and receives configurationinformation from the related object 110 f; and sends that as part of theCTD part of the information 217 to the collector 210 such as noted forthe configuration source 216 collecting the configuration information ofthe object 110 c. As noted, the network object 110 f is related to theobject 110 c because the application 114 is obtaining data from theobject 110 g through the object 110 f. Thus, this flow logs informationof information 217 collected from the object 110 f may include flow logs246 of the communication between the objects 110 c and 110 f.

The sources 211-216 are connected to receive the source information(e.g., configuration information, flow log information and metricsinformation) from the network objects; and transmit the information tocollector 210 as the information 217. The information 217 may beperiodically transmitted by the sources to the collector, such as tensor hundreds of times during each selected period of time (e.g., see 360of FIG. 3).

Each of the sources 211-216 may be a pluggable application programinterfaces (API) source. In some cases, each of the sources 211-216 is a“pluggable” data source or collector that can be deployed in runtime orduring operation of the system 102 to enable process 300 of FIG. 3 to beperformed for various examples of the network 100, the selectedapplication 114, the period of time, the subsequent period of time, andthe time between an end of the period of time and a beginning of thesubsequent period of time. Using pluggable sources also allows thosesources to be deployed by the system 102 during subsequent periods oftime to expand the system 102 or fix pluggable sources that do notfunction correctly. This can enable non-disruptive break/fix cycles forthe system 102.

The collector 210 also includes a scheduler 219 for scheduling timeperiods for and determining whether to automatically repeat thecontinual automated discovering of the topology information (e.g., see360 of FIG. 3). In some cases, the scheduler 219 exists on the object130 and/or as part of data store 222. The collector 210 also includesthe CTD and TS information 217 determined based on the sourceinformation collected from sources 211-216; and for being sent to thenetwork object 130. The information 217 may be periodically transmittedby the collector to the network object 130, such as tens or hundreds oftimes during each selected period of time (e.g., see 360 of FIG. 3).

The network object 130 includes at least a data store 222, a time seriesprocessor 224 and a connectivity processor 226. The time seriesprocessor 224 and connectivity processor 226 are connected by networkconnections to and receive information 217 from the collector 210 asshown.

In some cases, a network configuration and time dimension information(CTD) part of the information 217 from the sources 211-216 is theconfiguration information collected by source 216 and the flow logsinformation collected by the source 213 for the application 114 and thenetwork objects related to the application 114. In these cases, the CTDpart of the information 217 is sent to the connectivity processor 226,which processes that information to determine or create unique keys of,types of objects of, types of relationships between pairs of, groupingsof and time dimension data of the network objects part of the topologyinformation 228. The time dimension data may show and/or show changesover time in the topology configuration or topology information 228 overtime, such as changes in the existence of, types of objects of, types ofrelationships between pairs of, and groupings of the network objects. Itis considered that in certain cases, the TS part of the information 217may also be processed by the processor 226 to determine or create uniquekeys of, types of objects of, types of relationships between pairs of,groupings of and time dimension data of the network objects part of thetopology information 228.

In these cases, the timeseries information (TS) part of the information217 from the sources 211-216 is the metrics information (e.g.,timeseries data) collected by metrics sources 211 and 212 for theapplication 114 and the network objects related to the application 114.In these cases, this TS part of the information 217 is sent to the timeseries processor 224, which processes that information to determine orcreate timeseries data part of the topology information 228. Thetimeseries data may show and/or show changes over time in theperformance metrics of the network objects of the topology configurationor topology information 228. It is considered that in certain cases, theCTD part of the information 217 may also be processed by the processor224 to determine or create the timeseries data part of the topologyinformation 228.

The CTD and TS part of information 217 includes the CTD and TSinformation for each of relationships 182, 184 and 186; and for each ofthe network objects 110 b, 110 d, 110 h and 110 i. The CTD and TSinformation for relationships 182, 184 and 186; and the network objects110 b, 110 d, 110 h and 110 i is generated using at least the gatheredflow log data, metric data and configuration data gathered by the flowlog sources, metrics source and configuration source of object 120.

The CTD and TS part of information 217 for each of the network objects110 b and 110 d is the CTD and TS information for the set of the networkobjects of the macro-cluster 150. The CTD and TS part of information 217for each of the network objects 110 h and 110 i is the CTD and TSinformation for the set of the network objects of the macro-cluster 160.

The CTD and/or TS part of information 217 for relationships 186 may be amacro-cluster CTD and/or TS part of information 217 for the relationshipbetween macro-clusters 150 and 160. In some cases, the one or more typesof relationship (e.g., of relationship 186) between macro-clusters 150and 160 is the one or more types of relationships that exists betweenobjects 110 b and 110 i. In some cases, the types of relationshipsbetween macro-clusters 150 and 160 includes other types of relationshipsbetween other ones of network objects 150 and 160, such as types ofrelationships existing between objects 110 b and 110 h; 110 d and 110 h;and/or 110 d and 110 i. In other case, the one or more types ofrelationships between macro-clusters 150 and 160 is one or more types ofrelationships that can only exist between macro-clusters and isdifferent than any type of relationship between network objects. Therelationship and type of relationship between macro-clusters 150 and 160may be a relationship between a logical abstraction one level up fromthe objects of macro-cluster 150 and 160. In some cases, therelationship and type of relationship between macro-clusters 150 and 160may be a relationship between the unique keys for the macro-cluster 150and 160.

The TS part of information 217 may be optional and excluded in somecases.

The time series processor 224 and the connectivity processor 226 arealso connected to and transmit the topology information 228 to the datastore 222 based on or determined from the information 217 received fromthe collector 210 and data received from the data store 222 as shown.This topology information 228 may be periodically transmitted fromprocessors 224 and 226 to the data store 222 as noted for periodictransmission of information 217.

The data store 222 includes the stored topology information 228 that isreceived from the time series processor 224 and the connectivityprocessor 226. The data store 222 also includes graph representations230 for displaying (e.g., creating and/or displaying) various graphrepresentations of topology information 228.

The topology information 228 and graph representations 230 are createdusing the CTD and TS information for each of relationships 182, 184 and186; and for each of the network objects 110 b, 110 d, 110 h and 110 i.The topology information 228 and graph representations 230, each includea mapping of at least one type of relationship between the macro-cluster150 and the macro-cluster 160. In one example, relationship 186 may beor include that the network object 110 b of macro-cluster 150 iscommunicating with, has a link with and/or has a type of communicationrelationship with the network object 110 i of macro-cluster 160.

The topology information 228 and graph representations 230, each includea mapping of topology information of the set of the network objects 110b and 110 d of the macro-cluster 150. This may be or include that thenetwork object 110 b is communicating with, has a link with and/or has atype of relationship with the network object 110 d; and that both ofthese objects are a part of macro-cluster 150. It can be appreciatedthat there may be other network objects in the set of network objects ofmacro-cluster 150 and that each of these other network objects in theset will be have a type of relationship with at least one other networkobject of macro-cluster 150.

The topology information 228 and graph representations 230, each includea mapping of topology information of the set of the network objects 110h and 110 i of the macro-cluster 160. This may be or include that thenetwork object 110 h is communicating with, has a link with and/or has atype of relationship with the network object 110 i; and that both ofthese objects are a part of macro-cluster 160. It can be appreciatedthat there may be other network objects in the set of network objects ofmacro-cluster 160 and that each of these other network objects in theset will be have a type of relationship with at least one other networkobject of macro-cluster 160.

The data store 222 is connected to and transmits the topologyinformation 228 back to the time series processor 224 and theconnectivity processor 226. For example, the processing of theinformation 217 performed by processors 224 and 226 to determinetopology information 228 may depend on (1) the new data coming in asinformation 217, and (2) the state of the topology information 228 is itcurrently exists and as it was in the past. The information about thepast state of topology information 228 is already stored in the datastore 222, such as past versions of topology information 228. The stateof the topology information 228 is it currently exists and as it was inthe past flows along the two arrows from 222 to 224 and 226. Thistopology information 228 may be periodically transmitted from the datastore 222 to processors 224 and 226 as noted for information 217.

The network object 120 may represent a first “agent” such as hardwareand/or software executing on a first network object or in a first“cloud”. A cloud is one or more servers or sets of computing devicesthat are located separately from each other, such as across a networkinterface or connection. The network object 130 may represent a second“agent” such as hardware of and/or software executing on a secondnetwork object or in a second “cloud”.

The first and second network objects or agents communicate with eachother to perform the continual automated discovering of the topology forthe executing application 114. In some cases, the object 120 or thefirst agent may be described as a state maintaining or service providerside or cloud of the system; and the object 130 or the second agent maybe described as a remote or customer side or cloud of the system. In oneexample, the objects 120 and 130 are generic physical network objectarchitectures that achieve detecting the topology information in a waythat is independent of a specific cloud provider, such as the AmazonCloud™, Microsoft Cloud™ or Google Cloud™. In this case, the object 110c may be cloud based, such as including a cloud based router, switch orflow logs providing service (e.g., cloud provider service by GoogleCloud™), and the flow logs are virtual private cloud (VPC) flow logs fornetwork communication being performed by the object 110 c.

In some cases, the objects 120 and 130 are not limited to beingimplemented in a cloud. They can function very well with an on-premiseor local area network (LAN) installation. In this situation instead ofusing flow logs source 213 and 215 to read flow logs, those sourcescould read equivalent “flow logs” of a local switch, router, service andthe like which are very similar to VPC flow logs and can be produced bysome hardware switches.

Using the system 102 and the connections shown it is possible to performcontinual automated discovering over (e.g., during) a selected period oftime (and optionally subsequent periods of time) of the topology ofnetwork objects for the selected executing application 114. Using thesystem 102 and the connections shown it is possible to perform continualautomated discovering over (e.g., during) a selected period of time (andoptionally subsequent periods of time) of the topology of and map therelationships between macro-clusters of the network objects. Displayingthe graph representation of this topology and these relationships is onetype of use of the discovered topology information 228. In addition tothat functionality of visualization, the topology information 228 hasother important uses. Specifically, the topology information 228includes a representation of knowledge on how the relationships betweenmacro-clusters and network object sets for each macro-cluster work withrespect to its interaction and communication with other (e.g.,“related”) macro-clusters and/or network objects. The topologyinformation 228 can be a model usable to analyze situations where amacro-cluster, a relationship between macro-clusters and/or networkobjects of a macro-cluster are not working correctly and to helpidentify why it they are not working correctly using topologyinformation of a related macro-cluster or set of network objects ofthose macro-clusters.

Description of Processes

Referring now to FIG. 3, there is shown an operating environment/process300 for discovering and mapping the relationships between macro-clustersover a selected period of time of the topology information of networkobjects for the selected executing application 114 of the computercommunication network 100. The process 300 may be or describe anoperating environment in which the system 102 can perform thediscovering and mapping of the relationships between macro-clusters andthe network object sets for each macro-cluster of a network objecttopology of a computer communication network. The process 300 may beperformed by the system 102. The process 300 starts at 305 and can endat 370, but the process can also be cyclical as shown by the “yes” loopfrom 360 to 310, which provides discovering and mapping of topologyinformation in a “continual automated” manner. The process 300 may beperformed after selecting object 110 c and/or application 114. It can beappreciated that the process 300 can be repeated to determine thetopology information 228 and/or graphic representations 230 for selectedobjects or applications, other than selected object 110 c and/orapplication 114. For example, during the period of time or anotherperiod of time, another one of collector 210 can be used by object 120to perform the process 300 to discover and map topology information 228and/or graphic representations 230 for the relationship 186 betweenmacro-clusters 150 and 160; and the network object sets for each ofmacro-clusters 150 and 160 using the objects 110 c, 110 e and 110 f.

After 305 where process 300 starts, the process continues to 308 where aremote network object is selected that has a type of relationship with afirst macro-cluster that has a type of relationship with a secondmacro-cluster of a network. Selecting at 308 may be selecting a remotenetwork object 110 c that has a type of relationship with macro-cluster150 of the network 100 that includes a set of the network objects 110 band 110 d. The network 100 includes macro-cluster 160 that includes aset of the network objects 110 h and 110 i. Each set of network objectsof a macro-cluster can be a plurality; two or more; between 2 and 1000;or between 3 and 100 network objects. Macro-cluster 150 has a type ofrelationship and/or is communicating with the second macro-cluster 160,such as by object 110 b having a type of relationship and/orcommunicating with the object 110 i.

Selecting the remote network object at 308 may be performedautomatically by the scheduler 219; or manually by a user at input 174.Selecting at 308 may be selecting application 114 as an application, acluster, and/or a network object that it is believed has a relationshipwith or will provide configuration and time data 217 to show networktopology information desired to discover the network topology ortopology information of related macro-clusters 150 and 160. Selecting at308 may be selecting application 114 that is known to have at least onerelationship with another network object from which configuration andtime data 217 can be gathered that will provide topology information 228for relationship 186 between macro-clusters 150 and 160; and for thenetwork objects of macro-clusters 150 and 160.

Selecting at 308 may include selecting a period of time for determininga network topology of an application executing on a network. This isselecting the “selected” period of time noted above and increasescomputer efficiency because there is a gap in time between such selectedperiods of time (e.g., see at 360) during which the topology does notneed to be determined.

Selecting the period of time at 308 may be performed automatically bythe scheduler 219; or manually by a user at input 174. Selecting at 308may include selecting the period of time, the subsequent period of time,and a time between an end of the period of time and a beginning of thesubsequent period of time at noted at 360. This selecting a period oftime may be used by the collector 120 to program or control the sources211-216 to collect the information 217 only during the period of timeand/or subsequent periods of time.

After 308, at 310 a portion may be selected of a set of data messagesbeing sent during or over the selected period of time of 308 by aselected application 114 executing on a selected network object of aplurality of network objects of the network 100. Selecting at 310 may beselecting a portion of a set of data messages being sent and beingreceived during the selected period of time of 308 by a selectedapplication 114.

In some cases, selecting the portion at 310 includes selecting between 2and 10 percent of the set of data messages of the selected softwareapplication 114. In other cases, selecting the portion at 310 includesselecting between 5 and 25 percent of the set of data messages.Selecting at 310 may be selecting a portion of a set of data messagesbeing sent or that have been sent over the period of time by theapplication 114. This selecting may be performed by collector 210 andmay be used by the collector 120 to program or control sources 211-216to collect the information 217 only for the selected portion of the setof data messages.

Selecting a portion at 310 may include the collector 210 parsing the setof data messages based on at least one statistical analysis thatidentifies trends in data message flow direction and convergence betweenthe application 114 and the other network objects; then selecting theportion of the set of data messages based on the trends. The statisticsmay include statistics about flow records that are similar, count,average and sum the number of packets and bytes.

Selecting a portion at 310 increases computer efficiency because itavoids reading all the logs 244 of the set of messages by sources211-216 or into the collector 210. Reading all of the logs may create anundesirable network load in or at application 114, the network object110 c and/or a virtual private cloud (VPC) and/or network of thatapplication or object. In addition, selecting a portion may avoidsending all the logs 244 or raw data for or all of the logs 244 from thecollector 210 to the network object 130. Sending all the logs or rawdata can be redundant and potentially overload the entire system 102.This overloading may overload both of the network objects 120 and 130with data transmissions thus slowing or stopping processing orperformance.

In some cases, in addition to selecting a portion of the set of messagesfor the application 114, selecting at 310 also includes selectinganother portion of another set of data messages being sent and/orreceived during the selected period of time by a related applicationand/or network object. For example, selecting 310 could include alsoselecting portions of the sets of data messages sent and received by therelated application 116 and/or the related network object 110 f, similarto the selecting a portion of the set of messages sent by theapplication 114.

After 310, at 315 flow log data from communication flow logs, metricdata and configuration data of the selected network object 110 c aregathered (or collected) using at least one flow log source, at least onemetric data source and at least one configuration source, respectively.In some cases, gathering at 315 may be gathering the flow log data fromcommunication flow logs, metric data and configuration data from objects110 c, 110 e and 110 f using the sources.

Gathering at 315 may be gathering flow log data from communication flowlogs, metric data and configuration data from the period of time andportion of data messages from 308-310. The network object 120 mayperform this gathering (e.g., collecting). Specifically, this collectingmay be performed by the sources 211-216 reading or receiving sourceinformation from the executing application 114 and/or the selectedobject 110 c. Collecting at 320 may also include the sources 211-216reading the communication flow logs (e.g., the flow logs 244) of theselected network object 110 c, where each flow log is associated with adata message received or transmitted by the selected executingapplication 114. Reading by the sources 211-216 may be controlled by thecollector 210. For example, the controller 210 may cause sources 211-216to only read the data at 315 for the portion of messages selected at310; and to only read information 217 during the period of time selectedat 308, and optionally during one or more subsequent periods of time(e.g., see at 360).

After 315 at 320 network configuration information and time data isgenerated (or detected) for the network objects of and relationship 186between the macro-clusters 150 and 160 using the flow log data, metricdata and configuration data from gathering at 315. Generating thenetwork configuration information and time data at 320 includesgenerating that data for at least the macro-clusters 150 and 160; and/orat least the network objects 110 b, 110 d, 110 h and 110 i using theflow log data, metric data and configuration data from gathering at 315.Generating at 320 may include generating the network configurationinformation and time data for relationships 182 and 184. In some cases,at 320 the network CTD and TS information 217 is generated from theperiod of time and portion of data messages from 308-315.

For example, based on the data read from the flow logs 244, theexecuting application 114 and/or the selected object 110 c, theconfiguration source 216 may detect the configuration information partof some of the CTD part the information 217 of the macro-clusters 150and 160, and relationship 186. Next, based on the data read from theflow logs 244, the executing application 114 and/or the selected object110 c, the flow logs source 213 may detect the flow logs information ofsome of the CTD part of the information 217 of the macro-clusters 150and 160, and relationship 186. Also, based on the data read from theflow logs 244, the executing application 114 and/or the selected object110 c, the metrics sources 211 and 212 may detect the metricsinformation of the TS part of the information 217 of the macro-clusters150 and 160, and relationship 186. In some cases, being based on thedata read from the executing application 114 and/or the selected object110 c, includes being also based on the data from objects 110 e and 110f.

From the network CTD and TS information 217 generated at 320 it ispossible to determine the network topology information (e.g., see at330) of the network object 110 b, topology information of the networkobject 110 d, that the network object 110 b has a relationship 182 withthe network object 110 d, topology information of the macro-cluster 150(such as the type of macro-cluster that cluster 150 is; and that thenetwork objects 110 b and 110 d are part of the macro-cluster 150),topology information of the network object 110 h, topology informationof the network object 110 i, that the network object 110 h has arelationship 184 with the network object 110 i, topology information ofthe macro-cluster 160 (such as the type of macro-cluster that cluster160 is; that the network objects 110 h and 110 i are part of themacro-cluster 160); and that the macro-cluster 150 has a relationship186 with the macro-cluster 160. From the CT and TS information 217 it isalso possible to determine the types of relationships of each ofrelationships 182, 184 and 186.

In some instances, to gather at 315, generate at 320 and/or determinetopology information 228 at 330, only the network object 120 iscollecting the information 217 from the network 100, thus, the object120 is collecting the information 217 in an “agent-less” fashion. Ascompared to an agent-based collection, this agent-less fashion increasescomputer efficiency because it avoids having a collecting agent orcollection resource located on each network object, resource or host ofthe network 100.

When gathering at 315, the API sources 211-216 may use a remote accesssource such as remote desktop services to access the selected networkobject 110 c and read data from the application 114 and thecommunication flow logs 244. Using remote desktop services increasescomputer efficiency because it allows the object 120 to access theapplication 114 and the communication flow logs 244 (e.g., access object110 c) using low level permissions as compared to a collection using midor high-level permissions. In some instances, the object 120 access tothe application 114 only requires a low level of permissions and avoidsneeding administrator or root level permissions to the minimum amountrequired to collect information 217. The API sources 211-216 may use oneor more remote access sources to access network objects 110 e and 110 f,similar to using a remote access source to access object 110 c.

Each flow log of the logs 244 may include data in all or at least thefirst 8 of the following fields: version, account-id, interface-id,srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start,end, action, log-status. Here, any of the sources 211-216, the collector210, the processor 224 and/or the processor 226 (e.g., see at 330) canuse the data in srcaddr, srcport and dstaddr, dstport to determine theinformation 217 or the topology information 228 including to determinethe source network object (e.g., source IP address), target networkobject (e.g., target IP address) and possibly type of communication ofthe communication message of that log. The source network object (e.g.,source IP address) and target network object (e.g., target IP address)may be determine when IP addresses that show up in the flow log(srcaddr, dstaddr) are both familiar. The type of communication may bedetermined based on the ports used by that communication identified inthe log, because different applications traditionally use specific ports(for e.g. MySQL™ is using port 3306 by default). Collecting and usingthe information 217 from the flow logs 244 increases computer efficiencybecause it allows the sources 211-216 to determine the topologyinformation 228 for the information 217 collected from a singleapplication 217.

In some cases, the flow logs 244 read by the flow logs source 213 onlyidentify a source network object IP address and a target network objectIP address for some of the data messages. This may happen when the flowlogs 244 are read from a flow log service of a cloud configuration. Forthese messages, the identified IP addresses identified by the source 214can be sent by the controller 210 to the object 130 in the information217. However, this leaves a portion of the data messages for which theflow logs 244 read by the flow logs source 213 do not identify any orall of a source network object IP address or a target network object IPaddress. For this portion of messages, the configuration source 216 canobtain and/or the processor 226 can determine (e.g., see at 330) the IPaddresses of the source and/or target network objects based on the typeof the network object that the source 216 detects in the configurationinformation it reads from those objects. Here, the IP addressesidentified and/or configuration information for determining thoseaddresses can be sent by the controller 210 in the configuration part ofinformation 217. Using the configuration source 216 to determine the IPaddresses that were not determined by the flow logs source 213 increasescomputer efficiency because it provides the source and/or target networkobject IP addresses that would otherwise not be available.

Each of the flow logs of logs 246 may include similar data fields as, beaccessed similarly as, and/or be read similarly as flow logs of logs244.

In some cases, generating at 320 includes the collector 210 sending theconnectivity processor 226 the network CTD part of information 217 whichincludes or can be used to identifying unique keys of the networkobjects, IP addresses of the network objects, types of objects of thenetwork objects, types of relationships between pairs of the networkobjects, groups of the network objects and time dimension data for thenetwork objects in the topology for the executing application 114 duringthe selected period of time. The collector 210 may also send the timeseries processor 224 the TS part of information 217 which includes orcan be used to identify timeseries data for the network objects in thetopology for the executing application 114 during the selected period oftime.

In some cases, generating at 320 includes the network object 120transmitting or sending to the network object 130, only a portion of theinformation 217 collected from the portion of data messages. In someinstances, the sources 211-216 read the information 217 from thecommunication flow logs 244 and send that information to the collector210. The collector 210 then time stamps the read information 217. Italso creates statistics about the time stamped information 217. Thestatistics may include statistics about flow records that are similar,count, average and sum the number of packets and bytes. In some cases,the collector 210 can create, maintain or store statistics about flowrecords of the logs 244 that are similar (srcaddr, srcport and dstaddr,dstport), count, average and sum the number of packets and bytes toreduce what is stored at the object 120, or sent by the object 120 inthe information 217 to the object 130. This allows for a highlyefficient, and yet simple way of filtering the flow logs sent by thecollector 210, which increases computer efficiency because it reducesthe amount of data sent to the object 130.

For example, based on the statistics, the collector 210 can filter thetime stamped information 217 to remove redundant information; and thentransmit the filtered information 217 to the network object 130. Thecollector 210 may send the connectivity processor 226 the filterednetwork CTD information for the executing application 114 during theselected period of time. The collector 210 may also send the time seriesprocessor 224 the filtered TS information for the executing application114 during the selected period of time.

In some instances, during collection of the information 217 ordetermining of topology information 228, the only communication betweenthe objects 120 and 130 is the one-way transmission of the information217 from the object 120 to the object 130. By only communicatingone-way, there are fewer restrictions and/or permissions required by theapplication 114 (or the object 110 c) from the object 120 (e.g., foraccess to and collection of the information 217) because the information217 is being communicated away from or is going outside of theapplication 114. This going outside case increases computer efficiencybecause the application 114 usually has a less restrictive firewallsetting and requires less internal approvals from the object 120; ascompared to if the object 120 is sending data to or writing to theapplication 114 or the object 110 c.

In some cases, in addition to collecting a portion of the set ofmessages sent by the application 114, collecting at 320 also includescollecting the CTD and TS information 217 from other portions of datamessages sent by a related application and/or network object. Forexample, collecting at 320 could include collecting CTD and TS parts ofinformation 217 from portions (e.g., see selecting at 310) of the setsof data messages sent by the related application 116 and/or the relatednetwork object 110 e, similar to the collecting a portion of the set ofmessages sent by the application 114 and/or the object 110 c. Here,configuration source 216 collects the configuration information of theapplication 216 and/or the object 110 e; and the metrics source C 214collects the metrics information of the application 216 and/or theobject 110 e.

Also, collecting at 320 could include collecting CTD and TS information217 from portions (e.g., see selecting at 310) of the sets of datamessages sent by a related application by (or through) and/or by therelated network object 110 f, similar to the collecting a portion of theset of messages sent by the application 114 and/or the object 110 c.Here, configuration source 216 collects the configuration information ofthe flow logs 246 and/or the object 110 f; and the flow logs source 215may also collect the flow logs information of the flow logs 246 and/orthe object 110 f.

After 320, at 330 the topology information 228 of the network objects ofeach of the macro-clusters 150 and 160; and the relationship 186 betweenthe macro-clusters 150 and 160 are determined. Determining at 330 mayalso include determining the topology information 228 for other networkobjects related to application 114. In some cases, determining at 330 isdetermining the topology information 228 of at least the network objectsof the macro-clusters 150 and 160; and the relationship between themacro-clusters 150 and 160. Determining at 330 may include determiningthe topology over the period of time at 308 and portion of data at 310based on the collected CTD and TS information 217 determined and sent at320. This determining may include continual and automated discoveringand parsing over time of the topology of the macro-clusters 150 and 160;and the relationship between the macro-clusters 150 and 160. Determiningat 330 may be performed by the connectivity processor 226 processing thenetwork CTD part of the information 217 sent by the collector 210 tocreate the connectivity part of the information 228 and/or by the timeseries processor 224 processing the TS part of the information 217 sentby the collector 210 to create the timeseries part of the information228.

Determining the topology information 228 of macro-clusters 150 and 160;and the relationship between those macro-clusters 150 and 160 at 330 mayinclude determining the network topology information of the networkobject 110 b, network topology information of the network object 110 d,that the network object 110 b has a relationship 182 with the networkobject 110 d, network topology information of the macro-cluster 150(such as the type of macro-cluster that cluster 150 is; and that thenetwork objects 110 b and 110 d are part of the macro-cluster 150),network topology information of the network object 110 h, networktopology information of the network object 110 i, that the networkobject 110 h has a relationship 184 with the network object 110 i,network topology information of the macro-cluster 160 (such as the typeof macro-cluster that cluster 160 is; that the network objects 110 h and110 i are part of the macro-cluster 160); and that the macro-cluster 150has a relationship 186 with the macro-cluster 160. It may also includedetermining the types of relationships of each of relationships 182, 184and 186.

For example, the connectivity processor 226 determines from the receivedCTD part of the information 217, the connectivity part of theinformation 228 which may include the unique keys of the networkobjects, the types of objects of the network objects, the types ofrelationships between pairs of the network objects, the groupings of thenetwork objects and time dimension data for the macro-clusters 150 and160; and the relationship 186 between those macro-clusters. The timedimension data may show changes over time in the connectivity part ofthe information 228, such as changes in the existence of, types ofobjects of, types of relationships between pairs of, and groupings ofthe macro-clusters 150 and 160; and the relationship 186 between thosemacro-clusters during the period of time. It is considered that incertain cases, the TS part of the information 217 may also be processedby the processor 226 to determine or create the connectivity part of thetopology information 228.

Also, the time series processor 224 determines from the received TS partof the information 217, the timeseries (e.g., metrics) part of theinformation 228 for the macro-clusters 150 and 160; and the relationship186 between those macro-clusters. The timeseries data may show theand/or show changes over time in the timeseries part of the information228, such as changes in the performance metrics of the macro-clusters150 and 160; and the relationship 186 between those macro-clustersduring the period of time. It is considered that in certain cases, theCTD part of the information 217 may also be processed by the processor224 to determine or create the timeseries part of the topologyinformation 228.

The determined topology information 228 at 330 can be stored in the datastore 222 as noted at 340 and/or displayed in a graph representation asnoted at 350.

In some cases, determining the topology information 228 at 330 alsoincludes the connectivity processor 226 sending the processedconnectivity part of information 228 (e.g., what the processor 226determines from the received CTD part of the information 217) to thedata store 222; and receiving from that store 222 current and/or priordetermined connectivity information (e.g., a stored model of a priorconnectivity part of the topology for the macro-clusters 150 and 160;and the relationship 186 between those macro-clusters at a prior pointin time). The connectivity processor 226 then determines theconnectivity part of the information 228 using the configuration part ofthe information 217 received from the collector 120 and the priorconnectivity information part of topology information 228 received fromthe store 222. Similarly, determining the topology information 228 at330 may also include the time series processor 224 sending the processedtimeseries part of information 228 (e.g., what the processor 224determines from the received TS part of the information 217) to the datastore 222 and receiving from that store 222 current and/or priordetermined timeseries information (e.g., stored timeseries data for aprior topology for the macro-clusters 150 and 160; and the relationship186 between those macro-clusters at a prior point in time). The timeseries processor 224 then determines the timeseries part of theinformation 228 using the time series part of the information 217received from the collector 120 and the prior timeseries informationpart of topology information 228 received from the store 222. Receivingthe information from the store 222 increases computer efficiency becauseit allows the processors 224 and 266 to compare and identify differencesover time between recently received versions of the information 217 andthe stored prior information 228 received from the store 222. In someinstances, determining at 330 may include determining the topologyinformation 228 of an average network with 200 hosts (e.g., networkobjects) within 15 minutes at an accuracy of 70% and within additional45 min (total 60 min from start) at an accuracy of 95%, meaning that 95%of the connections between network objects of the topology of theexecuting application will be discovered.

Determining the topology information 228 at 330 may include determiningthe physical network objects, virtual network objects, softwareapplications and/or hardware of the macro-clusters 150 and 160; and therelationship 186 and may also include determining them for each networkobject that the macro-clusters 150 and 160; and the relationship 186 arerelated to or communicating with. In some cases, at least networkobjects 110 c, 110 e and 110 f are related to macro-clusters 150 and160; and the relationship 186 as noted above. For example, the topologyinformation 228 may be for the macro-clusters 150 and 160; and therelationship 186 and show the selected application 114 and/or networkobjects 110 c, 110 e and 110 f communicating with or having arelationship with the macro-clusters 150 and 160; and the relationship186, such as shown in FIG. 4.

The determined topology information 228 may be unique keys of thenetwork objects, types of objects of the network objects, types ofrelationships between pairs of the network objects, groupings of thenetwork objects, time dimension data for each of the macro-clusters 150and 160; and the relationship 186 (e.g., the connectivity part of theinformation 228), and optionally timeseries data (e.g., metrics data orthe timeseries part of the information 228) of any network objects thatare discovered or determined to be part of the topology information 228of the network 100 for the macro-clusters 150 and 160; and therelationship 186 during the period of time.

The unique key of a network object may be one (a single) key thatuniquely identifies each network object from the other network objects,the macro-clusters and the relationships of the topology. The unique keyof a macro-cluster may be one (a single) key that uniquely identifieseach macro-cluster from the others, the relationships and the networkobjects. A unique key may also be a key that uniquely identifies arelationship between macro-clusters such as relationship 186 from anyother relationship, any network object and any macro-cluster. Each keymay be determined or selected by the connectivity processor 226 from orbased on the configuration part of the information 217 received from thecollector 210 and of the topology information 228 received from thestore 222 by the connectivity processor 226. In some cases, everynetwork object of the topology information 228 has at least one uniquekey and may possibly have multiple “keys” that are completely unique. Aunique key cannot be repeated or reused within a single network objector macro-cluster; and cannot be used in or for more than one networkobject or macro-cluster of the topology information 228 (e.g., becausethat would lead to these two objects or clusters to be merged into asingle object or cluster).

As information 217 is collected for the network objects and/ormacro-clusters, each object and/or macro-cluster is given unique key byprocessor 226 on a case by case basis. The unique keys are derived bythe processor 226 per specific network object and/or macro-cluster fromwhat of the topology information 228 can represent this object in aunique way, within the specific technology domain of the network 100.Every new object, macro-cluster and/or technology that is added to thetopology requires the processor to make a decision about what key (orset of keys) should be used for this situation, object and/or cluster.In some cases, if it is available, the key is a fully qualified name(FQN) of a server. In cloud systems (e.g., cloud objects 140), usuallythe cloud provider has or provides specific keys that represents eachobject which can be used as a unique key. For example, AWS (AmazonCloud™) has a set of internal unique keys (e.g.,ARN—Amazon-Resource-Name) per each network object of a network that theprocessor 226 can use as the unique keys. Similar sets of keys fromother cloud providers such as Microsoft Cloud™ or Google Cloud™ can beused. In a different domain, such on-premise the processor 226 can uselogical media access control (MAC) addresses and/or physical MACaddresses from networking or other identification keys from technologiessuch as VMWare™ or other virtualization and cloud computing software. Insome cases, a fully qualified uniform resource locator (URL) may beused. It can be appreciated that a mixture of the above noted keys, orother data of information 217 can be selected or used to create theunique key for each of the network objects and/or macro-clusters oftopology information 228.

A macro-cluster unique key given by object 130 may be based on a uniquekey of one of the network objects of that cluster, a number of thenetwork objects of that cluster or another process. For example, eventhough the macro-cluster may be a number of network objects workingtogether to perform a service, there may not be a physical networkobject that represents the entire macro-cluster to get a key from. Thekey of each macro-cluster can be determined using a process thatconsiders the key of one or more of the objects of that cluster. Here,in one case, that macro-cluster's key can be derived from one or more ofthe network objects of that macro-cluster, such as by adding a characterto one of the object keys; sorting the keys of all that cluster'sobjects and appending them to make a big key, or hashing them to inventa key. Here, in another case, that macro-cluster's key can be determinedby another process such as by looking a key up from a look up table orlist. The key for each cluster can be a list of the keys of all of theobjects that cluster. The list may be sorted in one of various ways,such as by lexicographically, alphabetically and/or numerically. In somecases, the key of all the macro clusters is determined using the sameprocess and so that no two macro clusters have the same key.

A type of object of a network object may be a type of physical networkobject and/or a type of virtual network object as noted herein.

A type of macro-cluster of a macro-cluster may be a type of physicalmacro-cluster and/or a type of virtual macro-cluster. A type ofmacro-cluster given by object 130 may be based on a type of object ofone of the network objects of that cluster, a number of the networkobjects of that cluster or another process. This may be similar todetermining the unique key of the macro-cluster as noted above, butinstead for the type of object of the macro-cluster.

The type of macro-cluster for each cluster can be a list of the types ofobjects of all of the objects that cluster. The list may be sorted inone of various ways, such as by lexicographically, alphabetically and/ornumerically. The type of macro-cluster for each cluster can be based onthe goal of the cluster, software of the cluster or an application thatthe cluster implements. For instance, the type may be a similar goalthat two or more network objects of the cluster are working towards. Insome cases, the type of macro-cluster of all the macro clusters isdetermined using the same process and any of the macro clusters may bethe same type.

A type of relationship between network objects may broadly be a networkrelationship, a data relationship, a functional relationship betweenpairs of the network objects. In some cases, a type of relationshipbetween pairs of the network objects may be a network object controllingactions performed by another network object, a network objectcommunication with another network object, a network object depending onanother network object in order to operate correctly, and/or a networkobject streaming data to another network object.

A type of relationship between macro-clusters may broadly be a networkrelationship, a data relationship, a functional relationship betweenpairs of the macro-clusters. In some cases, a type of relationshipbetween pairs of the macro-clusters may be a macro-cluster controllingactions performed by another macro-cluster; a macro-clustercommunication with another macro-cluster, a macro-cluster depending onanother macro-cluster in order to operate correctly, and/or amacro-cluster streaming data to another macro-cluster. A type ofrelationship between macro-clusters may also be or include a type ofrelationship between network objects. A type of relationship betweenmacro-clusters given by object 130 may be based on a type ofrelationship between a network object of one of the clusters and anetwork objects of the other cluster, the type of relationship between anumber of the network objects of the two clusters, or another process.This may be similar to determining the unique key of the macro-clusteras noted above, but instead for the type of relationship between themacro-cluster.

The relationship and type of relationship between macro-clusters may bebetween a logical abstraction one level up from the objects ofmacro-cluster and/or between the unique keys for the macro-clusters. Thetype of relationship between macro-clusters may be a list of the typesfor each relationship between the objects of the two clusters. The listmay be sorted in one of various ways, such as by lexicographically,alphabetically and/or numerically. The type of relationship betweenmacro-clusters can be based on the goal of the two clusters, software ofthe two clusters and/or an application that the two cluster implement.For instance, the type of relationship may be a similar goal that two ormore network objects of the one of the clusters are working towardsappended with a similar goal that two or more network objects of thesecond of the clusters are working towards. In some cases, the type ofrelationship between all related macro clusters is determined using thesame process and any of the types may be the same type.

However, these examples of relationships are not limiting. Any type ofrelationship between network objects and/or macro-clusters can beexpressed including relationships that are newly discovered by theprocessor 226 and were not previously programmed into that processor.

Time dimension data for a network object may be data that describeschanges of that object over time. In some cases, the time dimension datamay describe the occurrence and timing of the addition, existence anddeparture of network objects from the topology information 228 over theperiod of time.

Time dimension data for a macro-cluster or relationship betweenmacro-clusters may be data that describes changes of that macro-clusteror relationship over time. In some cases, the time dimension data maydescribe the occurrence and timing of the addition, existence anddeparture of macro-clusters or relationships from the topologyinformation 228 over the period of time. The time dimension data for amacro-cluster may be based on a time dimension data of one networkobject of that cluster, a number of the network objects of that clusteror another process. This may be similar to determining the unique key ofthe macro-cluster as noted above, but instead for the type of object ofthe macro-cluster.

The time dimension data for each macro-cluster may be the time dimensiondata for a logical abstraction one level up from the objects ofmacro-cluster and/or for the unique key for that macro-cluster. The timedimension data of a macro-cluster can be based on or an aggregate of thetime dimension data for each of the objects of that macro-cluster. Forexample, the time dimension performance of the cluster may have aminimum based on the worst performing object and a maximum based on thebest performing object of that cluster. The time dimension data for amacro-cluster may be that of a combination of or for a list of all ofthe objects of that cluster. The list may be sorted in one of variousways, such as by lexicographically, alphabetically and/or numerically.The time dimension data of a macro-cluster can be based on the goal ofthe cluster, software of the cluster and/or an application that thecluster implements. For instance, the time dimension data may be that ofa similar goal that two or more network objects of the cluster areworking towards. In some cases, the time dimension data of all of themacro clusters is determined using the same process and any of the thatdata may be the same for any two clusters.

These descriptions can be determined using or based on the CTD and/or TSpart of the information 217.

For example, the CTD part may be used by the processor 266 to determinetime dimension data including the existence and properties of themacro-clusters and relationship between those macro-clusters over thetime period. This may include the processor 226 and/or data store 222keeping topology information 228 over the period of time that includestime related notes of the events of when a macro-cluster and/orrelationship between macro-clusters was created or stopped existing aswell as when certain properties of that macro-cluster and/orrelationship between macro-clusters changed. This part of theinformation 217 can be queried by a user, within a required time rangeor the period of time. This may also include the processor 226 and/ordata store 222 keeping topology information 228 that includes timerelated notes of when relationships between pairs of macro-clusters andrelationship between those macro-clusters began, changed and ended.These relationship notes can all be kept with a timestamp with relationto the macro-clusters and relationship between those macro-clusters sothis part of the topology information 228 can be later queried by auser, within a time range.

In some cases, the timeseries part of topology information 228 for amacro-cluster and/or relationship between macro-clusters may be datathat describes changes in metrics over time for that macro-cluster andrelationship in the topology information 228. For example, the TS partof the information 217 may be used by the processor 224 to determinetimeseries part of the information 228 including the different metricssignals of the macro-clusters and relationship between thosemacro-clusters over the time period. This may include the time seriesprocessor 224 and/or data store 222 keeping topology information 228that includes time related notes of the timeseries data of measuredsignals (e.g., collected at 320) that relate to each macro-clusterand/or relationship between macro-clusters. The timeseries notes of thetimeseries part of the information 228 are obviously related to a timeand this part of the information 228 can be queried by a user, based ona time interval.

As part of determining the topology information 228 at 330, the networkobject 130 or the processor 226 may maintain a list of IP addressesand/or unique keys of the macro-clusters and relationship between thosemacro-clusters received in the information 217; and determine if one ofthese IP addresses and/or unique keys changes over time based oncomparing the IP address and/or unique key of that macro-cluster and/orrelationship in the list with subsequently IP addresses and/or uniquekeys for that macro-cluster and/or relationship received in theinformation 217. Determining the topology information 228 at 330 caninclude comparing this list over time to determine IP address and/orunique key changes of the macro-clusters, types of relationship changesbetween pairs of the macro-clusters, time dimension data and timeseriesdata for the macro-clusters and/or relationships during the period oftime. Using this list and comparison increases computer efficiencybecause it more accurately determines the topology information 228 formacro-clusters and/or relationships that having changing IP addressesand/or unique keys, such as cloud services that rotate IPs periodically;and helps the sources 211-218 create a continuous stable connectivitywith the macro-clusters and/or relationships.

In some cases, part of determining the topology information 228 at 330includes determining the types of macro-clusters and/or the types ofrelationships between pairs of the macro-clusters based on grouping ofmultiple network objects and/or metrics determined for the networkobjects. In some cases, part of determining the topology information 228at 330 includes automatically grouping network objects having a commonfunction into cluster subsets and service subsets by creating a numberof abstraction layers by interpreting low level relations between pairsof the network objects and collapsing functional groups of the networkobjects into higher level macro-clusters (e.g., macro cluster 150).

For example, this automatically grouping may include automaticallydetecting and segmenting macro-clusters: functional groups such as amicro-service (from that micro-service's low level communication andconfiguration dependencies) and allowing a grouping of set of resourceswith a common function (such as a cluster, a scaling group, amicro-service, and the like), and allowing a collapsed and/or expandedview (from an API perspective of the sources 211-216) of thesefunctional groups. In some cases, part of determining the topologyinformation 228 at 330 includes semi-automatically grouping such as whenthe automatic grouping is confirmed or activated by a user or systemadministrator of system 102. Creating the groupings, macro-clusters,collapsed views and/or expanded views at 330 increases computerefficiency because they can also be used by the object 130 to determinethe types of network objects and/or the types of relationships betweenpairs of the network objects during the period of time.

Determining and/or mapping the topology information (e.g., of thenetwork objects grouped as) macro-clusters and relationship betweenmacro-clusters at 330 may be described as looking at parts of topologyinformation 228 from a level up or above that of the network object onlyview. It is looking at the topology from a level of abstraction that ismoved up to determine and/or map any group (e.g., macro-cluster) ofnetwork objects that are doing work towards (e.g., performing actions toachieve) a similar goal and/or expose other network objects (e.g. to theoutside of the group) an interface for accessing a combined output ofthe group. After the groups are determined, the relationships betweenmacro-clusters can be determined and/or mapped.

A macro-cluster may be detected or mapped by determining that thetopology information 228 includes a set of network objects having acertain or predetermined topology shape and/or set of relationships.Here, a group of network objects and/or of relationships betweenmultiple network objects can be automatically grouped into amacro-cluster by the system 102 and/or at 330. For example, when morethan a predetermined threshold number of objects having a predeterminednumber or type of relationships between them exist in the network, theymay form a macro-cluster.

For example, if the topology information includes two or more networkobjects communicating with an entry point object that have arelationship with two or more other network objects, the two or morenetwork objects and entry point object may be determined to be amacro-cluster.

A macro-cluster may be detected when a single entry point that receivesa communication or data request via a relationship with an object not inthe cluster, delegates the communication to one of multiple the internalobjects of the macro-cluster (e.g., creates communication/relationshipbetween the requestor and the delegated to object). The entry point maydelegate the communication to more than one object.

The single entry point may be a point from which communication getssplit or distributed to other objects of the cluster, thus forming themacro-cluster. In one case, a macro-cluster is detected when a loadbalancer type network object is performing balancing of thecommunications load between other network objects of the macro-cluster.For one example, a macro-cluster is detected when all therequests/communications received from outside the cluster by the entrypoint balancer network object are distributed in a round-robin patternbetween all the other network objects of the macro-cluster. For anotherexample, a macro-cluster is detected when all therequests/communications received from outside the cluster by the entrypoint are symmetrically distributed to all resource type network objectsof the cluster in a spoked or spiral pattern.

If the two or more other network objects that have a relationship withthe entry point object are part of another macro-cluster, thatrelationship may be detected or mapped as the relationship between thetwo macro clusters or upon which a relationship between the two macroclusters is based.

In another example, if the topology information includes between threeand a hundred network objects communicating with a single entry point orload balancing object that has a relationship with between five and amillion other network objects, the between three and a hundred networkobjects and entry point object may be determined to be a macro-cluster.In some cases, if the five and a million other network objects that havea relationship with the entry point object are part of anothermacro-cluster, that relationship may be the relationship between the twomacro clusters or upon which a relationship between the two macroclusters is based.

Other examples of relationships between macro-clusters include all of orsubset number of objects of a macro-cluster are communicating with anentry point object of another cluster; only 1 object of a macro-clusteris communicating with any one object of the other cluster; and/or allobjects of a cluster are (e.g., symmetrically) communicating with allobjects of another cluster.

Two or more network objects that are doing work towards a similar goalmay be determined and/or mapped as a macro-cluster. To determine and/ormap as a macro-cluster may require at least 3, 5 or 10 objects doingwork towards a similar goal.

Any one network object of one macro-cluster having a relationship withany one network object of another macro-cluster may be determined and/ormapped as a relationship between those macro-clusters. In other cases,to determine and/or map a relationship macro-clusters may require atleast 3, 5 or 10 objects of one cluster having relationships with atleast one object of the other cluster.

A threshold conditions or set of relationships for detecting that acluster exists is detecting a load balancer and creating a cluster forthe balancer and all objects having an immediate relationship with thatbalancer. A condition may be detecting two or more objects connected toa database object and creating a cluster for the database and allobjects having an immediate relationship and/or connection to thatdatabase. A condition may be detecting a network object topologicalsymmetry for three or more objects connected to each other and creatinga cluster for those objects. The symmetry may be a general networkobject symmetry; may be a symmetry based on two or more of the objectsperforming the same or a similar function; may be a symmetry based ontwo or more of the objects being the same type of object; and/or be asymmetry based on the system knowing that three or more network objectsare doing work (cooperating) towards a similar goal. A condition may bedetecting a logical abstraction one level up from a set of the objectsand creating a cluster of those objects. The system may discover newlogical abstractions and conditions for detecting a macro-cluster duringperformance such as during determining at 330, storing at 340 and/ordisplaying at 350.

Also, the macro-cluster (e.g., predetermined topology shape and/or setof relationships) can be monitored or continually mapped over a periodof time to detect a failure or performance degradation, such as whenmore than a predetermined threshold number of objects or relationshipsof the macro-cluster cease to exist or fail to exceed a metricperformance level.

The threshold number of objects and/or relationships may be based on alevel of performance for the cluster, relationship or communicationthereof. They may be based on a minimum communication requirement forthe clusters to be functioning correctly.

For example, they may require that two macro-clusters each have at least10 objects; and that at least 10 objects of one macro-cluster haverelationships with at least 10 objects of the other macro-cluster. Inanother case, they may require that there are any number ofrelationships between these macro-clusters.

If the number of objects and/or relationships fail to exist, the system102 may issue a warning or identify that an issue exists, such as frombusiness and/or network trouble shooting perspective.

As noted, the collected TS information 217 at 320 can include metricsdata information for each macro-cluster and relationship betweenmacro-clusters, which may be used to determine the timeseries part ofthe information 228. In some cases, part of determining the topologyinformation 228 at 330 includes time series processor 224 processing theTS part to automatically determine metrics for each macro-cluster andrelationship between macro-clusters of information 228. Thus,determining topology information 228 at 330 can include determining ifcritical metric data is missing for any of the macro-clusters and/orrelationships between macro-clusters based on the metric datainformation.

For example, based on the groupings, macro-components, collapsed views,macro-clusters, relationship between macro-clusters and/or expandedviews, the object 130 can determine what the critical metrics are foreach macro-cluster and what are the rolled-up individual key performanceindicators (KPI) to the macro-cluster level. Determining the criticalmetrics and KPI provides a critical capability to a user accessing ordisplaying a graph representation 230 of the topology information 228 byperforming calculations at 330 that are ad-hoc and constantly changingbased on the underlying changing resources and configurations of thedetermined metrics, groupings, macro-clusters, collapsed views and/orexpanded views. For example, a macro-cluster that is a service may havethe following rolled-up metrics: “Average CPU utilization”, “Max CPUutilization”, “95th percentile CPU utilization”, representing theroll-up of CPU metrics at a time where the number of hosts is constantlychanging over time. In one case, the macro-cluster 150 may have theserolled-up metrics that can be identified in the graph representation 230while the network objects of macro-cluster 150 in the topologyinformation 228 changes in number during the period of time. In somecases, this rolled up information will remain in the data store 222 asprior topology information 228, even after the network objects ofmacro-cluster 150 that were a part of the rolled up result no longerexist in the current topology information 228 (e.g., as they are of anephemeral nature in clouds or containers). So. the rolled up data can beused as evidence in a troubleshooting process for the of macro-cluster150 or relationship 186 even if some of the network objects ofmacro-cluster 150 at the time of a troubling issue are already gone fromthe current topology information 228. The determining of metrics data ofnetwork objects at 330 increases computer efficiency because the metricsdata can also be used by the object 130 to determine the types ofmacro-cluster and/or the types of relationships between pairs of themacro-clusters during the period of time.

The critical metrics and/or KPI of a macro-cluster may be those for alogical abstraction one level up from the objects of macro-clusterand/or for the unique key for that macro-cluster. The critical metricsand/or KPI of a macro-cluster can be based on or an aggregate of thecritical metrics and/or KPI data for each of the objects of thatmacro-cluster. For example, the critical metrics and/or KPI performanceof the cluster may have a minimum based on the worst performing objectand a maximum based on the best performing object of that cluster. Thecritical metrics and/or KPI data for a macro-cluster may be that of acombination of or for a list of all of the objects of that cluster. Thelist may be sorted in one of various ways, such as by lexicographically,alphabetically and/or numerically. The critical metrics and/or KPI dataof a macro-cluster can be based on the goal of the cluster, software ofthe cluster and/or an application that the cluster implements. Forinstance, the critical metrics and/or KPI data of a cluster may be thatof a similar goal that two or more network objects of the cluster areworking towards. The critical metrics and/or KPI of a cluster may be anaverage of that of all of the objects of that cluster over a period oftime. It may be based on the critical metrics and/or KPI data of onlysome of the objects of that cluster. for example, if a number of objectsof the cluster perform a similar function, are redundant and/or asimilar type, the data may be that for only a minimum number of thoseobjects required to continue performing the goal of that cluster. In oneexample, if only 2 of 10 objects that serve webpages are needed toperform the goal of the cluster, then the data will be for a combinationof any 2 or more of those objects that are functioning, even if theothers are not functioning or are broken. If only 1 is functioning thedata will show a fail of the cluster. Using an automobile analogy, theside view mirrors of a car may be broken but if the rearview mirrorfunctions, the car may be driven legally. In another example, if some ofthe objects are not needed to perform the goal of the cluster, then thedata will be for a combination of the objects that are needed for thegoal, even if the other objects are not functioning. If the neededobjects are not functioning the data will show a fail of the cluster.Using an automobile analogy, the blinkers and/or air conditioning of acar may be broken but if the other parts work, the car may be driven. Inanother example, if some of the objects are not needed to perform adifferent goal than the original or current goal of the cluster, thedata can also be for a combination of the objects that are needed forthe different goal, even if the other objects are not functioning andthe data shows a fail of the cluster for the original goal. In thiscase, an administrator may consider switching the goal or use of thatcluster to the different goal. Using an automobile analogy, a tire ofthe car may be broken, and the car may not be driven. However, this carmay still be run and the air conditioning used to keep cool. Thecritical metrics and/or KPI of a cluster may be based on a mathematicalprocess or calculation that has hysteresis. The critical metrics and/orKPI of a cluster may be based on a mathematical process or calculationthat is linear or one that is non-linear. In some cases, the criticalmetrics and/or KPI data of all of the macro clusters is determined usingthe same process and any of the that data may be the same for any twoclusters. The critical metrics and/or KPI of a cluster may be that of aload balancer, database object or network object topological symmetry ofthe cluster.

If the cluster, its network objects and/or a relationship betweenclusters fails a metrics threshold, the system 102 may issue a warningor identify that an issue exists, such as from business and/or networktrouble shooting perspective.

After 330, at 340 the topology information 228 of the macro-cluster andrelationship between macro-clusters over the period of time is stored.For example, at 340 the network object 130 may store the topologyinformation 228 received from the processors 224 and 226 in data store222. The data store 222 can be the storage 514 and/or the memory 512 ofFIG. 5. This storing may include the data store 222 storing theprocessed portion of the collected network CTD information sent by thecollector 210; and/or the processed portion of the collected TSinformation sent by the collector 210. The stored topology information228 may be sent to the processors 224 and/or 226 as shown by the arrowsin FIG. 2 for determining the topology information 228 during thecurrent period of time or a subsequent period of time (e.g., see at 360of FIG. 3). The stored topology information 228 may be used fordisplaying a graph representation 230 of the topology information (e.g.,also see FIG. 4) of macro-clusters 150 and 160; and relationship 186between those macro-clusters. In some cases, storing at 340 is notperformed and the process skips to displaying at 350.

After 340, at 350 a graph representation 230 of the topology information228 of the macro-cluster and relationship between macro-clusters overthe period of time may be created and/or displayed. The userinput/output (I/O) device 170 may be used to select creating and/ordisplaying one or more of graph representation 230 of macro-cluster andrelationship between macro-clusters at 350. This selection may cause thedata store 222 and/or the I/O device to access the topology information228 stored in data store 222 and create a graph representation 230 ofsome or all of that topology information 228 of macro-cluster andrelationship between macro-clusters for one or more points in timeduring the time period. The selection may also cause the data store 222and/or the I/O device to display the created graph representation 230 onthe display 172.

For example, at 350 a graph representation 230 of the topologyinformation 228 for the macro-clusters 150 and 160, and relationship 186which are related to the selected application 114 for the period of timemay be displayed on the display 172 (e.g., see FIG. 4). Creating and/ordisplaying the graph representation 230 increases computer efficiencybecause it shows a representation of each macro-cluster and relationshipbetween macro-clusters; the unique key of each macro-cluster andrelationship between macro-clusters, the types of object of each networkobject, the groupings of the network objects, the types of relationshipsbetween each pair of the macro-clusters, and time data of themacro-clusters and relationships between macro-clusters in the topologyinformation 228. Here, the “time data” is the time dimension data (e.g.,of the connectivity part of the information 228) and optionally, alsothe timeseries data (e.g., timeseries part of the information 228) ofthe macro-clusters and relationships between macro-clusters in thetopology information 228. The graph representation 230 may be atwo-dimensional or three-dimensional view of the requested part of thetopology information 228 that includes a map or graph, or topologyinterconnection display having: a representation of, unique keys of,type of object of, types of relationships between pairs of, groupingsof, and time data of each macro-cluster and relationship betweenmacro-clusters that satisfies the graph representation of topologyinformation 228 requested by the user.

The representation of each object may be an image, symbol, text and/oranother indicator that distinctly identifies each macro-cluster andrelationship between macro-clusters. For example, FIG. 4 shows theobjects as a desktop computer, server computer symbol or box containinga number of those objects, but those symbols are only representations asa macro-cluster or relationships between macro-clusters may actually beany of various types of object or shape. The type of macro-cluster andthe types of relationships between each pair of the macro-clusters maybe as noted herein. The time data for each macro-cluster andrelationship between macro-clusters may be used to show changes in thegraph representation 230 and in performance of the macro-clusters andrelationship between macro-clusters in that representation over time.

For example, creating and/or displaying at 350 may also show changes inthe graph representation 230 of the representation of eachmacro-clusters and relationship between macro-clusters over the periodof time. These changes may be based on the changes in time data (e.g.,time dimension data and optionally timeseries data) of the topologyinformation 228. Creating and/or displaying the changes in graphrepresentation 230 increases computer efficiency because it allows theuser to more easily identify and track changes of macro-clusters andrelationship between macro-clusters over time in the topologyinformation 228.

In some cases, the graph representation 230 may be a periodic sequentialseries over time of the graph representations of macro-clusters andrelationship between macro-clusters of the topology information 228during part or all of the period of time. In some cases, the graphrepresentation 230 may be one or more non-periodic series of the graphrepresentations of the topology information of macro-clusters andrelationship between macro-clusters at one or more points in time duringthe period of time. The user input 174 may be used to select displayingthe periodic sequential series and/or non-periodic series of the graphrepresentations of macro-clusters and relationship betweenmacro-clusters of the topology information at one or more points in timeduring the period of time.

For example, the display 172 or the input 174 may display a time barhaving a range from the beginning to the end of the period of time and aslidable location indicator on the time bar that can be located alongthe period of time by the input 174 (e.g., manipulated by sliding orclicking using a keyboard or mouse) to select displaying the graphrepresentation 230 of macro-clusters and relationship betweenmacro-clusters at/for points in time of the period of time selectedusing the indicator. The indicator may be slid forward or backward alongthe period of time to display the changes of macro-clusters andrelationship between macro-clusters between a first point in time and asecond point in time on the bar. The changes in the graph representation230 may be shown with marks such as highlighting, shadowing, fading,lightening, darkening, bold, underline, italics and/or the like.

Determining the topology information of the macro clusters 150 and 160and the relationship 186 between them at 330 may be mapping the topologyinformation of the macro clusters 150 and 160 and mapping therelationship 186 between them. Determining the topology information ofthe macro clusters 150 and 160 and the relationship 186 between them at330 and displaying a graphic representation of that topology informationat 350 may be mapping the topology information of the macro clusters 150and 160 and mapping the relationship 186 between them.

After 350, at decision block 360 it is decided whether process 300(e.g., 308-360; or optionally only 315-340) will be repeated. If so,process 300 returns to 308 where process 300 repeats for a subsequentperiod of time.

Process 300 may return to 310, such as where after returning to 310, theperiod of time referred to in 310-350 is for a subsequent period oftime. Here, the original or initial period of time may be referred to asa “first period of time.” If process 300 will not be repeated at 360,process 300 ends at 370. In some cases, process 300 is repeated forbetween ten and thousands of subsequent periods of time after the remotenetwork object is selected at 308. There may be a delay at 360 betweenthe first period of time during which messages were selected at 310, andthe subsequent period of time during which messages will be selected at310 after 360.

Deciding at 360 or causing repeating at 360 may be automaticallyperformed by a scheduler 219 of the collector 210 or performed by a userat the input 174. Selecting the period of time, the subsequent period oftime, and a time between an end of the period of time and a beginning ofthe subsequent period of time may also be automatically performed by thescheduler 219 or performed by a user at input 174.

In one case, the period of time is between 5 and 10 minutes, thesubsequent period of time is between 5 and 10 minutes, and thesubsequent period of time occurs after each end of a prior period oftime, one of periodically having a period that is between 50 to 70minutes, or randomly between 50 and 70 minutes after each end of a priorperiod of time. In another case, the period of time is between 2 and 5minutes, the subsequent period of time is between 2 and 5 minutes, andthe subsequent period of time occurs after each end of a prior period oftime, one of periodically having a period that is between 10 to 20minutes, or randomly between 10 and 20 minutes after each end of a priorperiod of time.

Repeating at 360 may be repeating selecting at 310, gathering at 315 andgenerating 320 for the at least one subsequent period of time. Repeatingselecting, gathering and generating at 360 may cause or includerepeating determining at 330 and storing at 340, for the at least onesubsequent period of time.

After 360, and repeating 310-340, displaying the graph representation230 at 350 may include displaying changes between topology informationof macro-clusters and relationship between macro-clusters for the periodof time and topology information for the subsequent period of time asnoted at 360. Displaying the changes may include graphically identifyingwhere changes in the graph representation 230 and/or the topologyinformation 228 of macro-clusters and relationship betweenmacro-clusters have occurred between the period of time and thesubsequent period of time with marks as noted at 350.

The gathering, generating and creating of 315-330 may be performed foror over a first and then over a later second period of time to createthe network topology information for or at the end of both periods.Based on these topologies, it can be detected if the relationship 186between macro-clusters 150 and 160 exists; and/or if both of thosemacro-clusters exist during or at the end of the second period. If therelationship 186, macro-cluster 150 or macro-cluster 160 does not existsduring or at the end of the second period, a network error message canbe transmitted to a network warning system or a system administrator ofsystem 102.

As an analogy, if you look at the parts of a car it breaks down to say60,000 discrete elements, but when a person thinks about a car they donot think of the 60,000 individual parts. Instead they think of it asdifferent sub-assemblies such as the wheels, engine, transmission,brakes, suspension, interior, seats, windows, audio, etc. and the waythose interact with each other. Another analogy is identifying a city bygrouping the roads and buildings having a certain density within anarea. This higher level of abstraction is like looking down at the roadsand buildings from 10,000 feet up in the air and realizing there are twotowns and they are connected by a road (e.g., the relationship betweenthem).

In the network setting, examples of macro-clusters are a group ofservers that serve as micro service, macro-structure or macro-cluster,such as a micro service that does an Internet search for terms enteredby a user or a micro service that finds prices of homes ataddresses/locations entered by a user.

Examples of the relationships between the macro-clusters are anyrelationships existing between pairs of objects of those clusters, suchas one or more relationships between objects of the micro services forsearching and for finding prices.

If each of those micro-services has 10 network objects, there may bedozens of relationships, each being between any of the objects of thesearch service and any object of the price service. In a network objecttopology, map or graphic display, the communications between thoseservices may look like a bunch of lines between any object of amacro-cluster to the left and any object of a macro-cluster to theright. There may be 100 lines between ones of the 10 objects on the leftand the 10 on the right. This can be very confusing. So, by moving thetopology abstraction layer up to the macro-cluster mapping, the searchservice can be one macro-cluster symbol (e.g., see cluster 150), theprice service can be another macro-cluster symbol (e.g., see cluster160) all of those relationships between their objects can be representedby a single relationship between the two macro-clusters (e.g., seerelationship 186). They may look like just two large circles and oneline between them which signifies/represents 100 possible differentconnections or relationships.

When a person looks at the representation or mappings of just theobjects, it may be very difficult to understand where a performanceproblem is, while looking at the macro-clusters and relationshipsbetween macro-cluster is easy to understand. In terms of a diagram orgraphic display, steps 320-350 provide the benefit of the ability tomore efficiently and intuitively identify what is going on and simplifythe presentation by detecting the micro services andcommunication/relationships of macro-clusters.

Determining and/or mapping at 330 may allow the macro-cluster to beviewed as a closed system. Here, it does not have to show or map what isin the macro-cluster, but can give some type of a service and show onlymacro-cluster 150 and 160, and relationship 186 without showing thenetwork objects of those macro-clusters.

Determining and/or mapping may allow for more efficient network troubleshooting. When something goes wrong, an important question is—what isthe topology or architecture of the network's macro-clusters? What unitsare in each macro-cluster? What are the relationships betweenmacro-clusters and/or between network objects of the macro-clusters.Determining at 330 and displaying at 350 more quickly answers thesequestions than without the topology of the macro-clusters andrelationships between macro-clusters.

There is a lot of value in being able to see that architecture bysub-assemblies or macro-clusters because it allows people to understandin the big picture when detecting where a problem exists. Is the car ornetwork not working because of a problem in a certain sub-assembly ormacro-clusters?It is easier to first detect if the problem is in acertain macro-clusters (e.g., a search micro-service or a priceproviding micro-service that feeds prices to the search micro-service)or sub-assembly (e.g., in the engine, in the transmission, in thesteering wheel sub assembly)? Once the subassembly or macro-clusterhaving the problem is identified, then it is easy to isolate that and godeeper into the individual elements or network objects to see which isfailing.

The topology of a macro-cluster having topology information showing afailure of the macro-cluster may be expanded to show the network objectsof that macro-cluster, and those objects can be selected to show theirtopology information to determine if one of them is failing. Also, thetopology of a relationship between macro-clusters having topologyinformation showing a failure of the relationship can be expanded toshow the relationships between the network objects of the two relatedmacro-clusters, and those relationships can be selected to show theirtopology information to determine if one of them is failing.

The user input 174 may be used to select displaying the graphrepresentation 230 of macro-clusters and relationship betweenmacro-clusters of the topology information at a point in time during theperiod of time, and a further graph representation of the change betweentopology information for that point and time, and a) another point intime during the period of time, or b) a subsequent point in time duringthe subsequent period of time. In some cases, the input 174 may be usedto select sequentially displaying the graph representation for a pointin time and a further point and time during the period of time, and/or asubsequent point in time during the subsequent period of time.

FIG. 4 shows a graph representation 400 of macro-clusters 150 and 160,and relationship 186 between those macro-clusters of topologyinformation of network objects of the computer communication network 100for the selected application executing 114 on the selected networkobject 110 c for a (e.g., a first) period of time. The graphrepresentation 400 may be the graph representation 230 of macro-clustersand relationship between macro-clusters of the topology information 228at a point in time during the (e.g., first) period of time at 360 ofFIG. 3.

The graph representation 400 for the software application 114 shows thenetwork object 110 b, the network object 110 c (the object whereapplication 114 is executing and communicating from), the network object110 d, network object 110 e, the cloud objects 140, the macro-cluster ofobjects 150 and the macro-cluster of objects 160.

It shows the selected software application 114 executing or running onthe network object 110 c; the related executing application 116executing or running on the network object 110 e; the network objects110 c and 110 e independent or stand-alone network objects; the networkobjects 110 b and 110 d as part of macro-cluster of network objects 160;the network objects 110 f and 110 g as part of a cloud service networkobjects 140; and the network objects 110 h and 110 i as part ofmacro-cluster of network objects 150. Each of the network objects 110b-110 i, and macro-clusters 150 and 160 is shown having connections,relationships and topology information as noted for FIGS. 1-3.Specifically, the graph representation 400 shows the network objects 110b and 110 d as part of macro-cluster of network objects 160 and havingrelationship 182; the network objects 110 h and 110 i as part ofmacro-cluster of network objects 150 and having relationship 184; andthe relationship 186 between macro-clusters 150 and 160.

It is noted that the network object 110 a of the network 100 is notincluded in the graph representation 400, because it is not part of thetopology information 228 at the point in time (e.g., during the periodof time) selected for the display of the graph representation 400.

For each of these network objects, the graph representation 400 shows agraph representation of that network object; the unique key of thatnetwork object; the type of object of that network object; the types ofrelationships between that object and each network object connected tothat object, the groupings for that network object, and time data forthat network object. For each of the macro-clusters 150 and 160, andrelationship 186 between those macro-clusters, the graph representation400 shows a graph representation of that macro-cluster; the unique keyof that macro-cluster; the type of object of that macro-cluster; thetypes of relationships between those macro-clusters and eachmacro-cluster connected to that macro-cluster, the groupings for thatmacro-cluster, and time data for that macro-cluster. The time data maybe a change of the graph representation over time and/or a change of ashowing of the metrics data for each of the macro-clusters 150 and 160,and relationship 186 between those macro-clusters over time. Forexample, some macro-clusters 150 and 160, and relationship 186 betweenthose macro-clusters may be removed from and/or added to therepresentation; and/or small windows may be displayed next to each ofthe macro-clusters 150 and 160, and relationship 186 between thosemacro-clusters showing one or more metrics data for each object may bedisplayed.

Specifically, the graph representation 400 shows an image of a desktopor server computer for each network object a rectangle and a label forthe groupings for each group of the network objects; and lists textrepresenting each network object's unique key, type; relationships andtime data for each of: the network object 110 b, the network object 110c, the network object 110 d, network object 110 e, the cloud objects140, the macro-cluster 150, the relationship 186 and the macro-cluster160. The image of a desktop or server computer is only usedrepresentatively as the type of network object of each network objectmay vary widely as noted herein.

As noted at 350 of FIG. 3 the graph representation 230 and/or thetopology information 228 may change over time. For instance, the input174 may be used to select one or more of the graph representations 230to be displayed for various points in time during period of time and/orduring a subsequent period of time.

Displaying the representation 400 may be selected using user the input174, such as described herein. Notably, an indicator on the display 172may be slid forward along a time bar including the period of time andsubsequent period of time to show the representation for a subsequentperiod of time and the changes therein.

Creating and/or displaying the representation 400 increases computerefficiency because it provides an efficient way of combining graph datawith time dimension data and timeseries data for highly efficient accesstime for specific queries that are applicable for network management ofmacro-clusters and relationship between those macro-clusters.

FIG. 5 is a block diagram of a computing device 500. The computingdevice 500 may be representative of the system 102, the I/O device 170,the server 130 a, the object 120 and/or the object 130, herein. Thecomputing device 500 may be a desktop or laptop computer, a servercomputer, a client computer, a network router, a network node, a networkswitch, a tablet, a smartphone or other mobile device. In some cases, itis a network object or element as described herein. The computing device500 may include software and/or hardware for providing functionality andfeatures described herein. The computing device 500 may thereforeinclude one or more of: logic arrays, memories, analog circuits, digitalcircuits, software, firmware and processors. The hardware and firmwarecomponents of the computing device 500 may include various specializedunits, circuits, software and interfaces for providing the functionalityand features described herein. For example, a system of two physicalnetwork objects may provide continual automated discovering of thetopology information of macro-clusters and relationship between thosemacro-clusters.

The computing device 500 has a processor 510 coupled to a memory 512,storage 514, a network interface 516 and an I/O interface 518. Theprocessor 510 may be or include one or more microprocessors, fieldprogrammable gate arrays (FPGAs), application specific integratedcircuits (ASICs), programmable logic devices (PLDs) and programmablelogic arrays (PLAs).

The memory 512 may be or include RAM, ROM, DRAM, SRAM and MRAM, and mayinclude firmware, such as static data or fixed instructions, BIOS,system functions, configuration data, and other routines used during theoperation of the computing device 500 and processor 510. The memory 512also provides a storage area for data and instructions associated withapplications and data handled by the processor 510. As used herein theterm “memory” corresponds to the memory 512 and explicitly excludestransitory media such as signals or waveforms.

The storage 514 provides non-volatile, bulk or long-term storage of dataor instructions in the computing device 500. It may be internal orexternal storage. The storage 514 may take the form of a magnetic orsolid-state disk, tape, CD, DVD, or other reasonably high capacityaddressable or serial storage medium. Multiple storage devices may beprovided or available to the computing device 500. Some of these storagedevices may be external to the computing device 500, such as networkstorage or cloud-based storage. As used herein, the terms “storage” and“storage medium” correspond to the storage 514 and explicitly excludetransitory media such as signals or waveforms. In some cases, such asthose involving solid-state memory devices, the memory 512 and storage514 may be a single device.

The network interface 516 includes an interface to a network such as anetwork that can be used to communicate calls, signals, streams, arrays,flagged samples and feedback described herein. The network interface 516may be wired or wireless.

The I/O interface 518 interfaces the processor 510 to peripherals (notshown) such as displays, video and still cameras, microphones, keyboardsand USB devices.

In some cases, storage 514 is a non-volatile machine-readable storagemedium that includes all types of computer readable media, includingmagnetic storage media, optical storage media, and solid-state storagemedia. It should be understood that the software can be installed in andsold with the system 102, the object 120 and/or the object 130.Alternatively, the software can be obtained and loaded into the system102, the object 120 and/or the object 130, including obtaining thesoftware via a disc medium or from any manner of network or distributionsystem, including from a server owned by the software creator or from aserver not owned but used by the software creator. The software can bestored on a server for distribution over the Internet.

The technologies described herein provide various technologicalimprovements to computer performance and efficiently. For example, thesystem 102, the object 120, the object 130, the process 300, and/or thecomputing device 500 provide a much more accurate and efficient device(and process) for displaying a graph representation of a topology ofmacro-clusters and relationship between those macro-clusters over timefor a computer communication network. For example, the technologiesdescribed are technological improvements over those of the past becausethey can accurately, automatically and continually over time, discovertopology information and display graph representations of the topologyfor macro-clusters and relationship between those macro-clusters ofcomputer communication network.

More particularly, the technologies described provide computer networktopology mapping tools, systems and/or devices that automaticallydiscover the topology of macro-clusters and relationship between thosemacro-clusters of a network communicating at a large scale, store thetopology and allow quick access to the topology information in agraphical display. The technologies described do not require access tosensitive information, or administrator or root level permissions. Theyperform repeated discovery over time, compare changes, address largescale topologies of macro-clusters and relationship between thosemacro-clusters and deal with missing critical data. They alsoautomatically group resources (like a cluster or a service) and collectcritical metrics for each macro-clusters and relationship between thosemacro-clusters. The technologies described also provide a graphrepresentation of the topology of macro-clusters and relationshipbetween those macro-clusters that mixes data that is not pure graphicaland data that has a time dimension.

Within this description, the term “system” may mean a collection ofhardware, which may be augmented by firmware and/or software, thatperforms the described functions. An engine may typically be designedusing a hardware description language (HDL) that defines the engineprimarily in functional terms. The HDL design may be verified using anHDL simulation tool. The verified HDL design may then be converted intoa gate netlist or other physical description of the engine in a processcommonly termed “synthesis”. The synthesis may be performedautomatically using a synthesis tool. The gate netlist or other physicaldescription may be further converted into programming code forimplementing the engine in a programmable device such as a fieldprogrammable gate array (FPGA), a programmable logic devices (PLD), or aprogrammable logic arrays (PLA). The gate netlist or other physicaldescription may be converted into process instructions and masks forfabricating the engine within an application specific integrated circuit(ASIC).

Within this description, the term “system” may also mean a collection ofhardware, firmware, and/or software, which may be on a larger scale thanan “engine”. For example, a system may contain multiple processors, someof which may perform similar functions in parallel. The term “system”does not imply any physical separation or demarcation. All or portionsof one or more systems may be collocated on a common card, such as anetwork card 516, or within a common FPGA, ASIC, or other circuitdevice.

Although shown implemented in a computer, the processes and apparatusmay be implemented with any computing device. A computing device as usedherein refers to any device with a processor, memory and a storagedevice that may execute instructions including, but not limited to,personal computers, server computers, computing tablets, set top boxes,video game systems, personal video recorders, telephones, personaldigital assistants (PDAs), portable computers, and laptop computers.These computing devices may run an operating system, includingvariations of the Linux, Microsoft Windows, Symbian, and Apple Macoperating systems.

The techniques may be implemented with machine readable storage media ina storage device included with or otherwise coupled or attached to acomputing device. That is, the software may be stored in electronic,machine readable media. These storage media include magnetic media suchas hard disks, optical media such as compact disks (CD-ROM and CD-RW)and digital versatile disks (DVD and DVD±RW); flash memory cards; andother storage media. As used herein, a storage device is a device thatallows for reading and/or writing to a storage medium. Storage devicesinclude hard disk drives, DVD drives, flash memory devices, and others.

The system 102, the object 120 and/or the object 130 may includehardware, software, firmware, or a combination thereof. Additional andfewer objects, modules or other arrangement of software, hardware anddata structures may be used to achieve the processes and apparatusesdescribed herein.

CLOSING COMMENTS

Throughout this description, the technologies described and examplesshown should be considered as exemplars, rather than limitations on theapparatus and procedures disclosed or claimed. Although many of theexamples presented herein involve specific combinations of method actsor system elements, it should be understood that those acts and thoseelements may be combined in other ways to accomplish the sameobjectives. With regard to flowcharts, additional and fewer steps may betaken, and the steps as shown may be combined or further refined toachieve the methods described herein. Acts, elements and featuresdiscussed only in connection with one technology are not intended to beexcluded from a similar role in other technologies.

As used herein, “plurality” means two or more. As used herein, a “set”of items may include one or more of such items. As used herein, whetherin the written description or the claims, the terms “comprising”,“including”, “carrying”, “having”, “containing”, “involving”, and thelike are to be understood to be open-ended, i.e., to mean including butnot limited to. Only the transitional phrases “consisting of” and“consisting essentially of”, respectively, are closed or semi-closedtransitional phrases with respect to claims. Use of ordinal terms suchas “first”, “second”, “third”, etc., in the claims to modify a claimelement does not by itself connote any priority, precedence, or order ofone claim element over another or the temporal order in which acts of amethod are performed, but are used merely as labels to distinguish oneclaim element having a certain name from another element having a samename (but for use of the ordinal term) to distinguish the claimelements. As used herein, “and/or” means that the listed items arealternatives, but the alternatives also include any combination of thelisted items.

It is claimed:
 1. A method of mapping relationships betweenmacro-clusters of a network object topology of a computer communicationnetwork, the method comprising: selecting a remote network object thathas a relationship with a first macro-cluster of the network thatincludes a first set of the network objects, the network including asecond macro-cluster that includes a second set of the network objects,the first macro-cluster having a relationship with the secondmacro-cluster; gathering: communication flow logs of the selectednetwork object using a flow log source; metric data from the selectednetwork object using a metrics source; configuration data from theselected network object using a configuration source; generatingconfiguration data and time data for each network object of the firstset of network objects and of the second set of network objects usingthe gathered flow log data, metric data and configuration data; creatingnetwork topology information using the configuration data and time data,wherein creating comprises: automatically grouping network objectshaving a first common function into the first macro-cluster by creatinga first number of abstraction layers by interpreting low level relationsbetween first pairs of the network objects and collapsing a functionalgroup of the first network objects into the first set of network object,and automatically grouping network objects having a second commonfunction into the second macro-cluster by creating a second number ofabstraction layers by interpreting low level relations between secondpairs of the network objects and collapsing a functional groups of thesecond network objects into the second set of network objects; anddetermining: a unique key for the first macro-cluster and the secondmacro-cluster that each uniquely identify each macro-cluster from othermacro-clusters, the relationship between macro-clusters, therelationships between network objects and the network objects, amacro-cluster relationship between a first network object of the firstmacro-cluster and a second network object of the second macro-cluster,wherein the relationship includes one of the first macro-clustercontrolling actions performed by the second macro-cluster, the firstmacro-cluster depending on the second macro-cluster in order to operatecorrectly or the first macro-cluster streaming data to the secondmacro-cluster, a unique key for the remote macro-cluster relationshipthat uniquely identifies the relationship between the first and secondmacro-clusters from any other macro-cluster relationship, any networkobject and any macro-cluster, and macro-cluster topology information ofthe first set of the network objects and of the second set of thenetwork objects; and storing the topology information in a memory. 2.The method of claim 1, wherein gathering, generating and creating areperformed for/over a first period of time; wherein the network topologyinformation is first network topology information for the first periodof time, and further comprising: gathering, generating and creatingfor/over a second period of time to create second network topologyinformation for the second period of time; and transmitting a networkerror message if the second topology information does not include therelationship between the first macro-cluster and the secondmacro-cluster, and the topology information of the first set of thenetwork objects and of the second set of the network objects.
 3. Themethod of claim 1, wherein creating the network topology informationcomprises: discovering a first network object relationship between afirst network object of the first set of the network objects and a firstnetwork object of the second set of the network objects using theconfiguration data and time data, wherein the macro-cluster relationshipincludes the first network object relationship; discovering a first setof network object relationships between pairs of network objects of thefirst set of the network objects using the configuration data and timedata, wherein the macro-cluster topology information of the first set ofthe network objects includes the first set of network objectrelationships; and discovering a second set of network objectrelationships between pairs of network objects of the second set of thenetwork objects using the configuration data and time data, wherein themacro-cluster topology information of the second set of the networkobjects includes the second set of network object relationships.
 4. Themethod of claim 1, wherein: the relationship between the remote networkobject and the first macro-cluster is between the remote network objectand a first network object of the first set of the network objects; andthe relationship between the first macro-cluster and the secondmacro-cluster is between a second network object of the first set of thenetwork objects and a first network object of the second set of thenetwork objects.
 5. The method of claim 4, wherein creating the networktopology information of the first set of the network objects comprisesusing the configuration data and time data to determine: unique keys ofeach of the first set of the network objects; types of objects of atleast some of the first set of the network objects; types ofrelationships between pairs of the first set of the network objects; andtime dimension data of the first set of the network objects; and whereincreating the network topology information of the second set of thenetwork objects comprises using the configuration data and time datadetermine: unique keys of each of the second set of the network objects;types of objects of at least some of the second set of the networkobjects; types of relationships between pairs of the second set of thenetwork objects; and time dimension data of the second set of thenetwork objects.
 6. The method of claim 1, wherein creating the networktopology information includes determining: time dimension data for thefirst macro-cluster and the second macro-cluster, and a type ofmacro-cluster of each of the first macro-cluster and the secondmacro-cluster, and the type of macro-cluster is one of a micro-service,a cluster subset or a service subset.
 7. The method of claim 1, wherein:the macro-clusters are remote macro-clusters of the network objecttopology; the first macro-cluster is a remote first macro-cluster; thesecond macro-cluster is a remote second macro-cluster; the gathering isat a first local network object; the flow log source is located withinthe first local network object; the metric data source is located withinthe first local network object; the configuration source is locatedwithin the first local network object; the generating is at the firstlocal network object; the creating is at the second local networkobject; the network topology information is remote network topologyinformation; and the storing is at the second local network object. 8.The method of claim 7, wherein: the flow log source is a first remotepluggable application program interfaces (APIs) located locally withinthe first local network object; the metric data source is a secondremote pluggable application program interfaces (APIs) located locallywithin the first local network object; and the configuration source is athird remote pluggable application program interfaces (APIs) locatedlocally within the first local network object.
 9. The method of claim 1,wherein: the selected network object is one of the first set of networkobjects; the flow log data is also from communication flow logs of thefirst set of network objects; the metric data is also from the first setof network objects; the configuration data is also from the first set ofnetwork objects; and the relationship between the first macro-clusterand the second macro-cluster comprises a relationship between a firstnetwork object of the first set of the network objects and a secondnetwork object of the second set of the network objects.
 10. The methodof claim 1, wherein each flow log includes at least the followingfields: version, account-id, interface-id, srcaddr, dstaddr, srcport,dstport, protocol; the data in srcaddr is used to determine a sourcenetwork object IP address; the data in dstaddr is used to determine adestination network object IP address, and a type of communication ofthe communication message of that log is determined based on the portsused by that communication identified in the log.
 11. A system formapping relationships between macro-clusters of a network objecttopology of a computer communication network, the system comprising: afirst network object coupled to a first set and a second set of networkobjects, the first network object comprising a processor for: receivinga selection of a remote network object that has a relationship with afirst macro-cluster of the network that includes a first set of thenetwork objects, the network including a second macro-cluster thatincludes a second set of the network objects, the first macro-clusterhaving a relationship with the second macro-cluster; gathering:communication flow logs of the selected remote network object using aflow log source; metric data from the selected remote network objectusing a metrics source; configuration data from the selected remotenetwork object using a configuration source; generating configurationdata and time data for each network object of the first set of networkobjects and of the second set of network objects using the gathered flowlog data, metric data and configuration data; and a second networkobject coupled to the first network object, the second network objectcomprising a processor for: creating network topology information usingthe configuration data and time data, wherein creating comprises:automatically grouping network objects having a first common functioninto the first macro-cluster by creating a first number of abstractionlayers by interpreting low level relations between first pairs of thenetwork objects and collapsing a functional group of the first networkobjects into the first set of network objects, and automaticallygrouping network objects having a second common function into the secondmacro-cluster by creating a second number of abstraction layers byinterpreting low level relations between second pairs of the networkobjects and collapsing a functional group of the second network objectsinto the second set of network objects; and determining: a unique keyfor the first macro-cluster and the second macro-cluster that eachuniquely identify each macro-cluster from other macro-clusters, therelationship between macro-clusters, the relationships between networkobjects and the network objects, a macro-cluster relationship between afirst network object of the first macro-cluster and a second networkobject of the second macro-cluster, wherein the relationship includesone of the first macro-cluster controlling actions performed by thesecond macro-cluster, the first macro-cluster depending on the secondmacro-cluster in order to operate correctly or the first macro-clusterstreaming data to the second macro-cluster, a unique key for the remotemacro-cluster relationship that uniquely identifies the relationshipbetween the first and second macro-clusters from any other macro-clusterrelationship, any network object and any macro-cluster, andmacro-cluster topology information of the first set of the networkobjects and of the second set of the network objects; and storing thetopology information in a memory.
 12. The system of claim 11, wherein:the relationship between the remote network object and the firstmacro-cluster is between the remote network object and a first networkobject of the first set of the network objects; and the relationshipbetween the first macro-cluster and the second macro-cluster is betweena second network object of the first set of the network objects and afirst network object of the second set of the network objects.
 13. Thesystem of claim 12, wherein creating the network topology information ofthe first set of the network objects comprises using the configurationdata and time data to determine: unique keys of each of the first set ofthe network objects; types of objects of at least some of the first setof the network objects; types of relationships between pairs of thefirst set of the network objects; and time dimension data of the firstset of the network objects; and wherein creating the network topologyinformation of the second set of the network objects comprises using theconfiguration data and time data to determine: unique keys of each ofthe second set of the network objects; types of objects of at least someof the second set of the network objects; types of relationships betweenpairs of the second set of the network objects; and time dimension dataof the second set of the network objects.
 14. The system of claim 11,wherein creating the network topology information includes determining:time dimension data for the first macro-cluster and the secondmacro-cluster, and a type of macro-cluster of each of the firstmacro-cluster and the second macro-cluster, and the type ofmacro-cluster is one of a micro-service, a cluster subset or a servicesubset.
 15. The system of claim 11, wherein: the macro-clusters areremote macro-clusters of the network object topology; the firstmacro-cluster is a remote first macro-cluster; the second macro-clusteris a remote second macro-cluster; the gathering is at a first localnetwork object; the flow log source is located within the first localnetwork object; the metric data source is located within the first localnetwork object; the configuration source is located within the firstlocal network object; the generating is at the first local networkobject; the creating is at the second local network object; the networktopology information is remote network topology information; and thestoring is at the second local network object.
 16. The system of claim15, wherein: the flow log source is a first remote pluggable applicationprogram interfaces (APIs) located locally within the first local networkobject; the metric data source is a second remote pluggable applicationprogram interfaces (APIs) located locally within the first local networkobject; and the configuration source is a third remote pluggableapplication program interfaces (APIs) located locally within the firstlocal network object.
 17. The system of claim 11, wherein each flow logincludes at least the following fields: version, account-id,interface-id, srcaddr, dstaddr, srcport, dstport, protocol; the data insrcaddr is used to determine a source network object IP address; thedata in dstaddr is used to determine a destination network object IPaddress, and a type of communication of the communication message ofthat log is determined based on the ports used by that communicationidentified in the log.
 18. The system of claim 11, further comprising:the first network object: gathering the flow log, metric andconfiguration data over a period of time; and the second network object:changing the topology information over the period of time based on theflow log, metric and configuration data gathered over the period oftime.
 19. The system of claim 11, the system further comprising: a userinput device coupled to the processor; a display device coupled to theprocessor; and a memory coupled to the processor wherein the processorand the memory comprise circuits and software for performing the mappingthe network object topology.
 20. A non-volatile machine readable mediumstoring a program having instructions which when executed by a processorwill cause the processor to map relationships between macro-clusters ofa network object topology of a computer communication network, theinstructions of the program for: receiving a selection of a remotenetwork object that has a type of relationship with a firstmacro-cluster of the network that includes a first set of the networkobjects, the network including a second macro-cluster that includes asecond set of the network objects, the first macro-cluster having a typeof relationship with the second macro-cluster; gathering: flow log datafrom communication flow logs of the selected network object using a flowlog source; metric data from the selected network object using a metricssource; configuration data from the selected network object using aconfiguration source; generating configuration data and time data foreach network object of the first set of network objects and of thesecond set of network objects using the gathered flow log data, metricdata and configuration data; and creating network topology informationusing the configuration data and time data, wherein creating comprises:automatically grouping network objects having a first common functioninto the first macro-cluster by creating a first number of abstractionlayers by interpreting low level relations between first pairs of thenetwork objects and collapsing a functional group of the first networkobjects into the first set of network object, and automatically groupingnetwork objects having a second common function into the secondmacro-cluster by creating a second number of abstraction layers byinterpreting low level relations between second pairs of the networkobjects and collapsing a functional groups of the second network objectsinto the second set of network objects; and determining: a unique keyfor the first macro-cluster and the second macro-cluster that eachuniquely identify each macro-cluster from other macro-clusters, therelationship between macro-clusters, the relationships between networkobjects and the network objects, a macro-cluster relationship between afirst network object of the first macro-cluster and a second networkobject of the second macro-cluster, wherein the relationship includesone of the first macro-cluster controlling actions performed by thesecond macro-cluster, the first macro-cluster depending on the secondmacro-cluster in order to operate correctly or the first macro-clusterstreaming data to the second macro-cluster, a unique key for the remotemacro-cluster relationship that uniquely identifies the relationshipbetween the first and second macro-clusters from any other macro-clusterrelationship, any network object and any macro-cluster, and mappingtopology information of the first set of the network objects and of thesecond set of the network objects; and storing the topology informationin a memory.
 21. The non-volatile machine readable medium of claim 20,wherein each flow log includes at least the following fields: version,account-id, interface-id, srcaddr, dstaddr, srcport, dstport, protocol;the data in srcaddr is used to determine a source network object IPaddress; the data in dstaddr is used to determine a destination networkobject IP address, and a type of communication of the communicationmessage of that log is determined based on the ports used by thatcommunication identified in the log.